1

Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst reading up about this newly discovered complication. It's apparent that websites use a range of SSL/TLS type certificates. If the connection to one fails then browsers are equipped for a fall back protocol, which will use an alternative certificate for encryption. I have found this piece of text:

Any website that supports SSLv3 is vulnerable to POODLE, even if it also supports more recent versions of TLS. In particular, these servers are subject to a downgrade attack, in which the attacker tricks the browser into connecting with SSLv3. This relies on a behavior of browsers called insecure fallback, where browsers attempt to negotiate lower versions of TLS or SSL when connections fail.

Source

With this in mind. Since this has been made a public statement that SSLv3 is not secure, it'll attract the more malicious users to exploit it (tons more than previously). Which sparks the question:

In the time it takes for major/popular websites and browsers to switch out/disable SSLv3, currently (day 1 of the vulnerability's public release), how at risk are current social networking websites such as Twitter and Facebook. Which are currently using TLS 1.2, twitter being issued by Symantic and Facebook being issued by Digicert, with the server configurations (by assumption) to fall back to any encryption method which is not TLS1.0, but SSLv1 may be an alternative to not being completely dead?

4

Some portions of your question need to be clarified. The SSL/TLS encryption is based upon the cipher suites supported by both the client and the server. Not the certificates issued to each social networking site. The certificates issued do not have a bearing on a website's vulnerability to POODLE.

The fallback to another SSL version is only performed if both sides don't agree on a cipher suite. SSLv1 was never released. The only browser I know of that supports SSLv2 is IE (at least up through IE9 this was true). These versions of the protocol would still have to be supported by the server. Server's do have SSLv2 support, but rarely enabled by default.

All that being said, social networking sites aren't "at risk". The clients are at risk because its their credentials that can be decrypted. Facebook will roll out patches/updates to their servers so that SSLv3 is disabled to protect their users, but the servers themselves aren't being actively compromised.

1

The websites themselves aren't at risk. The user's data while it's on the website's connection is at risk. This is especially true for people on public wifi where the likelihood of an attacker being in control of user's traffic is much higher.

It's only in the case that an attacker exercises control over your connection that your data is at risk. Governments, ISPs, or someone else that has partial control of your connection (proxy, vpn, network admin, malicious hotspot) are the potential exploiters of the poodle bug.

Sites can be tested for their SSL 3.0 support at http://poodlebleed.com

Disclaimer: I produced this tool.

  • 2
    I would say reliance on the website poodlebleed is invalid, as it's not explicit on stating that the website(s) in question are vulunerable to SSLv3 type stealing(?) attacks, as it seems to be a check whether the site can be contacted on a SSL Port (443 by default) which all types of certificates use, it's a given that using a public hotspot can be a security risk even when using a website with a valid/seemingly secure connection, as packets can be intercepted in-transit from the users device through the gateway – Daryl Gill Oct 15 '14 at 23:19
  • Luke - it appears that all your posts are links to your tools. This sort of self promotion is not helpful. If your answer also includes information about why this tool is useful, it may be acceptable, but in any case you need to explicitly disclose your affiliation with the tool! – Rory Alsop Oct 16 '14 at 11:04
  • @Rory Thanks for the feedback. I've updated the answer to include the disclosure. I will certainly work to produce more quality content for future answers. – Luke Rehmann Oct 17 '14 at 23:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.