I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes the TLS_FALLBACK_SCSV (0x5600) suite designed to prevent Poodle. See cipher suite list below:

Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032)
Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007)
Cipher Suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011)
Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)
Cipher Suite: Unknown (0x5600)

When I looked at the TLS request sequence in the network capture it occurs over SSL 3.0 even though SSL3 isn't supported in the cipher suite list.

This doesn't look like Poodle. What i found the most interesting is that the negotiated cipher suite (in the Server Hello request) was TLS_RSA_WITH_AES_128_CBC_SHA.

Does this mean the encrypted session effectively took place using the SSL3_RSA_WITH_AES_128_CBC_SHA cipher suite? And is it vulnerable to the same SSL 3.0 CBC vulnerability used to recover plain-text data by Poodle?

  • Why do you think these ciphers are not available for SSL 3.0 ? RC4-SHA definitely is and AES128-SHA too. Otherwise it is really hard to see what actually is going on and what your question really is. I suggest that apart from better formatting the question for readability you also add a packet dump (cloudshark.org) and point out in which parts of the handshake you see which kind of problems. – Steffen Ullrich Mar 8 '15 at 10:11
  • 1
    Maybe you just think that SSL3_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_AES_128_CBC_SHA are different? They are not, it is in both cases AES128-SHA with code 0x00,0x2f as defined in RFC 3268. – Steffen Ullrich Mar 8 '15 at 10:20
  • Hi Stefan - I wasn't sure if TLS_RSA_WITH_AES_128_CBC_SHA/SSL3_RSA_WITH_AES_128_CBC_SHA were different. – Michael Mar 9 '15 at 15:13
  • I'm relatively new to network analysis. Thanks for the information and reference to RFC 3268. – Michael Mar 9 '15 at 15:21
  • Would you still recommend attaching a packet dump? – Michael Mar 9 '15 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.