POODLE: What It Is and What Lookout Has Done to Protect You

This week, Google researchers released information about a new SSL vulnerability called POODLE that lets criminals hijack your secured sessions, steal the information needed to pretend to be you, and then act on your behalf. Due to the actions Lookout has taken, all Lookout users are currently protected from this vulnerability when accessing our customer-facing Web and mobile properties.

What is POODLE?

Bodo Möller, Thai Duong, and Krzysztof Kotowicz, the researchers behind POODLE, explain that today’s vulnerability directly impacts SSL 3.0 --  an 18-year-old, outdated version that is, unfortunately, still widely supported. This is because SSL 3.0 acts as a fallback if better encryption options are not available or fail. A browser, in seeing the failure, will try older SSL versions in order to put the connection through securely and successfully. Knowing this, an attacker could purposefully cause HTTPS to fail, sending the connection down to SSL 3.0 and collecting the data as desired. Let’s look at a real life scenario. Say you’re working in a coffee shop and you decide to access your bank account over the shop’s Wi-Fi network. An adversary on the network could be listening to all the traffic happening over Wi-Fi and notice that you’re accessing a bank.  They may then decide to intercept your session and force it to failback from a more secure encryption option to SSL 3.0. Now you are vulnerable to POODLE. Through the POODLE exploitation process, the adversary takes bits of information out of your session cookie that may eventually lead to their ownership of your entire session cookie. At that point, they have stolen the cookie associated with your bank session and essentially hijack it and impersonate you. They have access to your bank account and anything that web interface allows you to do.

What steps has Lookout taken?

In order to mitigate the issue we are not using CBC (Cipher Block Chaining) -- the mode vulnerable to POODLE in SSL 3.0 -- until we can disable SSL 3.0 in the near future. Because of how ingrained this old version of SSL is in Internet communications, we are trying to account for any user-facing compatibility issues by shutting off support for SSL 3.0. And because we are not employing CBC at this time, users are not affected by POODLE despite that fact that Lookout still allows SSL 3.0. We are working to fix these compatibility issues as we speak and soon will remove support for SSL 3.0. Other companies are doing this as well. For example, Google is in the process of removing support for SSL 3.0 in its Chrome browser and warns that some websites will need to be fixed following the migration. Firefox will also disable SSL 3.0 in its November 25 release of the updated browser.

What can I do?

You want to make sure your browser doesn’t allow websites to load through SSL 3.0.

‍On Firefox:

1. Type “about:config” into your address bar.
2. Search for “security.tls.version.min”
3. Set that variable to “1”

Or you can use a plugin that will let you control which SSL version you use. On Chrome: Unless you’re pretty savvy working command lines, you won’t yet be able to tell your browser what SSL version to use. We expect that Google will release a plugin similar to Firefox’s in the future. If you’ve got that technical knowledge, you’ll want to use the command line flag “--ssl-version-min=tls1” to stop Chrome from connecting through SSL version 3.0.

‍On Internet Explorer:

1. Go to "Internet Options" in your start menu
2. Head to the “advanced tab” and make sure “use SSL 3.0” is deselected

On Safari: Apple has created a patch for three of its operating systems, Mountain Lion and Mavericks that should take care of the issue for you. It is already fixed in Yosemite. We are not aware of any patches for Safari available on Windows machines. If you’re using a mobile browser, we haven’t yet seen any remediation tactics you can use. You may, however, still be susceptible to POODLE. Be cognisant of which companies have (and have not) already addressed POODLE. If you’re unsure, ask.