It turns out that the Secure Sockets Layer (SSL) encryption we refer to as secure communication on the Internet has a vulnerability. Today, researchers from Google announced (PDF) that they have discovered a bug (POODLE) in the SSL 3.0 protocol. The exploit could be used to intercept sensitive data that is supposed to be encrypted between the client and the server.
The first exploit allows attackers to initiate a “downgrade dance” as Google calls it, which tells the client that the server does not support the more secure TLS (Transport Layer Security) protocol, and forces it to connect via SSL 3.0. From there, they can perform a man-in-the-middle attack to decrypt secure HTTP cookies. Google calls the vulnerability POODLE (Padding Oracle On Downgraded Legacy Encryption).
In other words, your data is no longer encrypted. Google researchers Bodo Möller, Thai Duong, and Krzysztof Kotowicz recommend disabling SSL 3.0 on both servers and clients. The server and client will default to the TSL to establish a secure connection, and exploitation will not be possible.
For end users, if your browser supports it, disable SSL 3.0 or better yet, use tools that support TLS_FALLBACK_SCSV (Transport Layer Security Signaling Cipher Suite Value). This will prevent downgrade attacks. Google has said it will begin testing in Chrome to disable the use of SSL 3.0 before removing support for the protocol completely from all of its products in the coming months. In fact, there is already a Chromium patch available that disables SSL.
The Mozilla Foundation also plans to disable SSL 3.0 in Firefox. “SSLv3 will be disabled by default in Firefox 34, which will be released on November 25.”
Anyone interested in disabling SSL 3.0 in Firefox can do so with the SSL Version Control add-on for Firefox.
Source: secnews.gr
