What is a POODLE attack?

A POODLE attack intercepts communications between browsers and web servers. If successful, it can expose users’ private information, such as passwords and payment card numbers.

What is a POODLE attack? Read this article to understand more about this type of threat!

Understanding the POODLE attack

POODLE (Padding Oracle on Downgraded Legacy Encryption) attempts to reverse the encryption performed on user data. This decryption of normally secure communications is possible thanks to several vulnerabilities.

To capture this information, attackers force browsers to use the SSL 3.0 protocol instead of other more secure protocols such as TLS. This is known as a software vulnerability. First brought to light in 2014 by 3 researchers from Google’s security team, numerous patches have been launched to address this issue with more than mixed success.

By forcing the downgrade, the attacker forces communications to use a flawed CBC (Cipher Block Chaining) encryption. This presents a security vulnerability, which is susceptible to a POODLE. Thus, systems supporting SSL 3.0 associated with a cipher suite using CBC modes can be victims.

Over the years, similar protocol backtracking attacks have surfaced, such as the SSL stripping attack. It is likely that new ones will surface.

How does the POODLE attack work?

The main problem comes from legacy systems that remain backwards compatible with older protocols like SSL 3.0. Indeed, systems can revert to SSL to solve performance or functionality issues.

Such backtracking in the name of a smoother experience unfortunately creates more problems than it solves. Malicious actors on the net are abusing this possible regression and exploiting all the SSL encryption bugs.

Here is a brief overview of how a POODLE attack works:

• The client and the server negotiate the connection. Both must support the chosen protocol. By default, the communication will always be on the most recent version of the protocol. If this fails, the same negotiation starts with an older protocol.
• If attackers manage to take control of the connection, they can enforce the SSL connection. Such intrusions are easier on free Wi-Fi networks in public places.
• When clients and servers interact with SSL 3.0, their communications are no longer secure. Its main vulnerability is that by sending data over many connections, each transmission leaks information . Its vulnerability comes from the fact that it does not fully verify the integrity of the fill before decryption.
• Therefore, perpetrators must implement MitM (man in the middle, a third party that sits between your browser and the Internet servers) attacks and run malicious scripts to trigger the downgrade of your connection. Once the connection is upgraded to SSL 3.0 support, the POODLE attack can occur. It exploits encryption and verification vulnerabilities to capture data in its original form.

The POODLE attack is dangerous but not so easy to implement

This type of attack is not within the reach of any script kiddie who would have unearthed some malicious scripts on the Dark Web. A minimum of knowledge is required and several technical actions are necessary to succeed in this type of attack.

A POODLE attack aims at forcing a website to abandon a secure connection via TLS. However, before the attack exploits the SSL 3.0 flaws, the perpetrators must meet the right conditions.

The best environment for a POODLE attack is an unsecured public network. These can be found anywhere, such as airports, parks or shopping malls.

What information can a POODLE attack obtain?

If a POODLE attack is successful, it can retrieve everything that users submit while browsing. This includes login information such as usernames, email addresses and passwords.

Hackers could get their hands on session cookies and authentication tokens. This theft could facilitate account takeovers or evenidentity theft. To put it simply, everything you carry with you when you browse as open session, tracking and more….

The easiest way to prevent POODLE attacks is to disable SSL 3.0 on both the server and the client. However, this may not be practical under certain conditions.

Preventing POODLE and similar attacks

Your connection to the Internet, websites, applications and other online services can never be 100% secure.

Securing your own digital presence is important.

Certain habits, settings and decisions make you more vulnerable. Here are some tips for protecting your Internet activities, the data you submit and your overall experience.

• Avoid connecting to unknown networks. Hotspots in public places can make users vulnerable to traffic interception. They can therefore open the door to MitM, SSL stripping and POODLE attacks.
• Do not trust HTTP websites (under any circumstances). If sites use HTTP, never reveal your login credentials or other personal information through them.
• Keep your operating system, browser and other software up to date. Use next-generation solutions and install updates to combat bugs and vulnerabilities. Many digital threats work because people keep using outdated versions.
• Use a VPN. A virtual private network secures your connection to any network. So if you enable a VPN and connect to public Wi-Fi, your traffic can’t be read by third parties Even if sites or networks don’t use proper encryption, a VPN will.