The POODLE (Padding Oracle On Downgraded Legacy Encryption) attack is a fallback attack that tries to downgrade the used TLS protocol version. Learn how to prevent SSL POODLE in this article!
Security Assessment
CVSS Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Vulnerability Information
The POODLE attack (Padding Oracle On Downgraded Legacy Encryption) was discovered by Bodo Möller, Thai Duong, and Krzysztof Kotowicz from the Google Security Team. It was announced publicly in October 2014 in a paper called This POODLE Bites: Exploiting The SSL 3.0 Fallback.
This attack is made up of two parts. A man-in-the-middle attack allows an attacker to force a connection between a server and a client to be downgraded from transport layer security (TLS) protocol encryption to SSL 3.0 encryption. This allows them to eavesdrop on the traffic between the client and the server and then decipher it.
The second part is a padding oracle attack that reveals the encrypted information (ciphertext) by repeatedly sending requests to a web server. This part of the attack exploits a security vulnerability in the CBC (cipher block chaining) encryption mode of SSL 3.0. Hence the need to downgrade that version of the protocol.
If a POODLE attack is successful, it allows an attacker to reveal sensitive data such as passwords, session cookies, or other authentication tokens that enable them to impersonate a user and gain access to a website. It can also lead to a leak of personal data, credit card numbers, and health records.
In other words, for a POODLE attack to be possible and succeed, several conditions need to be in place. Attackers must:
- Launch a successful man-in-the-middle attack (MITM) - which requires a certain set of circumstances in itself
- Force the victim to run malicious JavaScript and cause the server to downgrade or fall back on SSL 3.0
- Send requests to the server by varying the input in order to exploit the CBC vulnerability
- Monitor the server responses and resulting ciphertext to decrypt the information and gain access
If attackers can execute all of these steps, a POODLE attack is successful. In total, it only takes several minutes to complete the attack, given that the above conditions are met.
Any system that supports SSL 3.0 with CBC or implements an SSL/TLS suite is vulnerable to this type of attack. In addition, systems that reference SSL/TLS libraries (such as OpenSSL) are also possible targets. Moreover, as of 2014, it has been found that TLS protocol version 1.0 - 1.2 are also vulnerable to a POODLE attack and are even easier targets because no fallback to SSL is required as part of the attack.
How The Attack is being performed
Here is how a POODLE attack is executed, step by step:
1. An attacker executes a man-in-the-middle-attack which is more easily achieved on public networks with low security. This is often done by forcing a user to run malicious JavaScript on an innocently-looking website.
2. The MITM attack allows them to eavesdrop on the communication between the client and the server and interfere and add input to this traffic. This communication remains encrypted, so the attacker has to cause the server to downgrade to SSL 3.0 to exploit its vulnerability.
3. After successfully causing the server to switch to SSL 3.0 through a protocol downgrade dance, the attacker can begin with the padding oracle attack.
4. The attacker exploits the SSL 3.0 padding vulnerability, which allows them to recover ciphertext by sending numerous cookie-bearing HTTP POST requests to the server with varying inputs in the last block of the request.
5. By monitoring server responses and varying the input, attackers can recover the contents byte-by-byte. One byte of the cookie typically takes no more than 256 attempts to be revealed, and for a 16-byte cookie, this equals a maximum of 4096 requests.
How to Prevent SSL POODLE Attack
To prevent the POODLE attack, SSL 3.0 support must be disabled from both servers and browsers, and a secure TLS configuration must be put in place that, ideally, supports TLS 1.2 or higher.
In addition, you must also make sure to enable TLS_FALLBACK_SCSV. This protocol extension guarantees that during a negotiation, the protocol never falls back to earlier protocol versions that are below the highest SSL or TLS version supported by the server.
Implementing TLS_FALLBACK_SCSV means that SSL is only used when an existing legacy system is involved and not a downgrade attack that forces the server to skip versions and downgrade to SSL 3.0. Effectively, this stops the forced downgrade from occurring and thereby the whole POODLE attack.