4

Is there any evidence that the the POODLE SSL or TLS has actually been proven to be a risk for file transfer like SecureFTP etc...? ...or is it just a theoretical exposure?

  • Considering that any random dude with a laptop can do it on a public WiFi network, I'd say yes - but since the vast majority of users don't pay attention to this stuff, no one would know. – tlng05 Jan 13 '15 at 20:33
  • Are you asking how exploitable the POODL vulnerability is? That's normally how people talk about vulnerabilities. Some vulnerabilities are real and provable, but difficult to exploit. Sadly, that's perhaps better answered by someone who understands crypto, but this question was already thought it wasn't "on topic" (A real beef I have with the stackexchange mentality) – Steve Sether Jan 13 '15 at 22:49
2

The POODLE attack is actually very hard to pull off in real world conditions. A SecurityMetric blog post lays it out well:

Here’s an explanation of how an attack would have to take place in order for an attacker to exploit POODLE and assume the user’s identity on the target site.

The victim must be logged into a site using HTTPS (and the session cookie must not be expired)

The victim must browse to another website over HTTP before the session cookie expires

The attacker must write a custom JavaScript code to exploit POODLE. To date [OCT 22, 2014], no prepackaged tool has been published to exploit POODLE

The attacker must inject ~5,000 requests in order to decrypt the session cookie

Basically, this attack is extremely difficult because both the merchant and the user have to be vulnerable.

So to answer your question, this risk leans heavily to the theoretical side. I haven't found any news stories, blog posts, or security advisories saying that this exploit has been confirmed in the wild. POODLE has a high barrier to execution, and it's paid off.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.