The Attack of POODLE
This test will tell you whether your browser is vulnerable to POODLE
Update 11/18/14: Google released Chrome 39, which disables fallback to SSLv3 by default. This means the browser, by default, is safe from POODLE.
Update: Some browser builders have discussed plans to secure their software against POODLE over the course of the coming weeks. Mozilla announced that SSLv3 will be automatically disabled in Firefox 34, to be released on November 25. Microsoft issued an advisory acknowledging POODLE but didn’t mention a specific date for an update. In a blog post, Google says they “hope” to disable SSLv3 support in their products “in the coming months.” Apple, per their usual policy, has not discussed this security issue.
Security researchers at Google recently published information about a vulnerability in SSL version 3 (SSLv3), an outdated but widely used application layer encryption protocol. The POODLE vulnerability (which stands for Padding Oracle On Downgraded Legacy Encryption, in case you were curious) enables a hacker to perform a man-in-the-middle attack, or intercept and steal plaintext data in transit between user and server.
SSLv3 was developed in 1996, and the move to phase it out in favor of the superior TLS protocol began just a few years later. TLS was designed to be backwards-compatible with SSLv3 in order to maintain interoperability between new and old systems, as explained by the discoverers of POODLE in their full paper. As a result, SSLv3 remains supported by nearly all internet browsers in 2014. To try to overcome connection failures, browsers will typically revert to SSLv3 if the current version of TLS isn’t working. Attackers can take advantage of this feature by causing connection failures, and then exploiting the vulnerability when the browser uses SSLv3.
As the heralds of the vulnerability, Google is responding quickly to make their own products as secure as possible. Their blog post reads, “In the coming months, we hope to remove support for SSL 3.0 completely from our client products.” Twitter has already disabled support for SSLv3.
The POODLE vulnerability is less severe than Heartbleed and Shellshock, but is perhaps even more relevant to the everyday internet user because the best defense against it is changing your browser’s settings. Google researchers recommend supporting TLS_FALLBACK_SCSV, which prevents browsers from downgrading to SSLv3. If you use Internet Explorer, you can select “Internet Options” from the Start menu and go to the “Advanced” tab, then uncheck “Use SSL 3.0.” Firefox users can disable SSLv3 manually by going to the URL about:config or by installing a browser plugin. Google Chrome has begun testing a new version of the browser which disables fallback to SSLv3. Safari, as of now, does not allow users to disable it.
Disable your SSLv3 in your browser if possible and look into TLS_FALLBACK_SCSV if you need an extra layer of protection right away. Security at researchers are working on a patch, so we will update you as soon as a stronger solution is released.
