2

Normally, servers that support SSL 3.0 are vulnerable to the POODLE attack. But, consider a server that has the following interesting combination of features:

  • It supports SSL 3.0.

  • If you connect to it via SSL 3.0, the connection succeeds but it immediately returns a HTTP 302 redirect to a web page on a different host suggesting that you upgrade your browser to a more modern version. Any attempt to connect via SSL 3.0 triggers this auto-redirect; it will never return any content or do anything else.

Is this secure? Or is this also vulnerable to POODLE?

I am suspicious that this might be vulnerable to POODLE. From my understanding of the POODLE attack, the attack only relies on watching whether the server accepts or rejects some particular modified ciphertext. (What the server does after that -- e.g., sending a redirect -- seems irrelevant to the POODLE attack.) However, I'm not sure if I understand all the details. So, is this an effective defense against POODLE?

I do realize the typical advice is to disable SSL 3.0. So, just to be clear: I'm not asking whether you'd encourage me to configure my own server like this; I just want to know if a server that works like described above is secure or insecure. And I suspect there might be a reason why someone would do this: it ensures that IE6 users see a web page asking them to upgrade to a more modern browser, rather than just blocking IE6 entirely. I know about TLS_FALLBACK_SCSV, but my question remains valid for clients that don't support it. So, is this redirect thing an effective defense against POODLE?

Improve this question
7
  • I believe that IE 6 is unsupported and not receiving security updates. It is also hardly used. Why would you want to allow that to connect to your server?
    – Neil Smithline
    Jun 3, 2015 at 20:42
  • 1
    @NeilSmithline, this is not my server. If this combination is insecure, I might be able to make an argument to the owner of the server to change it. But if it's not secure, they have valid business reasons to do it this way (I already explained why in my question: to allow IE6 users to see a web page asking them to upgrade, rather than causing the browser to show an error page that makes it look like the site is down or doesn't exist; whether you like that reason or not, it is a valid, non-negligible business reason).
    – D.W.
    Jun 3, 2015 at 21:09
  • 2
    Also, Neil - sadly IE6 is still extensively used - which is why so many sites still try to support it. I agree with you that it shouldn't be around any more, but if your customers use it you need to have a strategy to move them off it while not persuading them to move to other providers.
    – Rory Alsop ♦
    Jun 3, 2015 at 21:12
  • It's not so much that I don't like it but that I'm concerned that there are potential security problems with it that you may be exposed to. That said, I do understand that business requirements sometimes override security requirements.
    – Neil Smithline
    Jun 3, 2015 at 21:14
  • 1
    I think your overall figure is right, but from corporates I have worked with, there are certain groups of customers who are very slow to upgrade.
    – Rory Alsop ♦
    Jun 3, 2015 at 21:17

1 Answer 1

Reset to default
3

This can probably be made safe, if some additional protections are added. POODLE can not be used to intercept an existing connection or to man-in-the-middle a future connection. Instead this attack only manages to slowly obtain more information about the encrypted data.

You will need to add an additional defense: any secrets sent over a SSL 3.0 need to be immediately invalidated. For instance, if a session cookie is received over a SSL 3.0 connection, invalidate that cookie.

With this addition, this can probably be made safe. Clients that only support SSL 3.0 will be safe, because all of their connections will be redirected, so these clients never get to see any sensitive information and the attacker will never be able to get a valid session cookie or similar sensitive data. Thus even if the attack would succeed it could not get any useful data back because no useful data gets exchanged. For clients that support both SSL 3.0 and SSL TLS 1.x, the additional defense should stop POODLE attacks. Since POODLE requires lots of attempts (new connections), immediately invalidating any session cookie sent within a SSL 3.0 connection should prevent a POODLE attacker from learning the session cookie.

Without this additional defense, just redirecting is probably not safe.

Improve this answer
9
  • I think this might overlook a specific scenario. My worry is that Victoria the Victim (a user of this site) will be using a browser that supports both TLS 1.0 and SSL 3.0. Suppose she connects to the server and logs in and receives a session cookie (no attack happens during this part, so this connection uses TLS 1.0). Then suppose that subsequently a man-in-the-middle tries to attack her. Can the MITM use the POODLE attack to learn the session cookie (this is the part that involves forcing a fallback to SSL 3.0)? I worry that the answer might be yes.
    – D.W.
    Jun 3, 2015 at 21:11
  • In other words, your answer makes sense for clients that only support SSL 3.0. But what about clients that support both SSL 3.0 and TLS 1.0? Are they at risk of POODLE attacks (when using a service provided by a site that's configured as described in my question)?
    – D.W.
    Jun 3, 2015 at 21:16
  • I think that the downgrade to SSL V3 happens during connection creation time @D.W. so you're scenario isn't possible.
    – Neil Smithline
    Jun 3, 2015 at 21:22
  • @NeilSmithline, I don't understand. Yes, I know that's when the downgrade happens. Why does that make the scenario I describe impossible? Can you elaborate? To make sure we're on the same page: In my scenario, my intent was that Victoria makes multiple connections to the server. The man-in-the-middle can choose which connections to tamper with; he can certainly leave the first one undisturbed and then tamper with later ones if he wants, for instance. (Also note that a MITM can force Victoria to make additional connections to the server by tampering with other unrelated HTTP connections.)
    – D.W.
    Jun 3, 2015 at 21:26
  • @D.W.: if the user has already a session cookie because of some TLS1.x connection before POODLE this might maybe used to determine the session cookie. Since lots of attempts (new connections) are necessary to do it it might be wise to make any session cookie sent within a SSL 3.0 connection immediately invalid.
    – Steffen Ullrich
    Jun 3, 2015 at 21:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .