Microsoft releases anti-POODLE Fix It

[Borg 386]

By default, Internet Explorer on Windows client systems supports SSL version 3.0, the version recently found vulnerable to attack. Now there's another way to turn it off.

Microsoft has released a Fix It to disable the feature which was the subject of the POODLE attack. The Fix It, a program which implements changes in the registry, makes the process simpler than the alternatives.

POODLE is a design flaw in SSL/TLS and so there is no patch to fix the bug. Instead, vendors are disabling support for SSL 3.0, a protocol which is old and deprecated anyway. The number of server systems which require SSL 3.0 is said to be small, but users of those servers will start having problems connecting as client systems begin to have their SSL 3.0 support removed.

Disabling SSLv3 support for Internet Explorer wasn't all that hard without the Fix It. Users could do so by unchecking the "Use SSL 3.0" option in the Advanced tab of the Tools-Internet Options dialog box. A group policy setting is available for managed environments (Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> Turn off encryption support).

Microsoft releases anti-POODLE Fix It | ZDNet

 

[Lady Fitzgerald]

I deselected "Use SSL 3.0" as soon as the word was out on the Poodle "bug" and haven't had any problems accessing websites. If I ever do, I wouldn't want to use it anyway.

 

[ThrashZone]

Yea this reads like anyone would be luckier to get hit by lightening 20 times before getting attacked by this Poodle :/
https://technet.microsoft.com/library/security/3009008

 

[sygnus21]

Please make sure you use the fix posted by Borg 386 to disable SSL 3.0 or you may run into issues with Amazon.com as well...



For IE11, it's rather simple...

Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 in Internet Explorer:

You can disable the SSL 3.0 protocol in Internet Explorer by modifying the Advanced Security settings in Internet Explorer.

To change the default protocol version to be used for HTTPS requests, perform the following steps:

1 - On the Internet Explorer Tools menu, click Internet Options.

2 - In the Internet Options dialog box, click the Advanced tab.

3 - In the Security category, uncheck Use SSL 3.0 and check Use TLS 1.0, Use TLS 1.1, and Use TLS 1.2 (if available).

4 - Note It is important to check consecutive versions. Not selecting consecutive versions (e.g. checking TLS 1.0 and 1.2, but not checking 1.1) could result in connection errors.

5 - Click OK.

6 - Exit and restart Internet Explorer.

Direct source to procedures: Microsoft Security Advisory 3009008

DO NOT assume this was already done by patch or update!!! I'm running Windows 8.1, with the latest version of IE11, and SSL 3.0 was STILL ticked!

I'm sure the procedures has been posted here somewhere, but just in case.

And for those of you still hanging on to those old browsers, it might be time to update... if for no other reason but for security, and/or banking/shopping convenience. I'm just saying

Peace

 

[sygnus21]

Oh snaps !!! :shock:

Disabling SSL 3.0 blocks me from using my school's website. And unfortunately I have to be able to access it to do my tests and in class projects



Well that puts me somewhere between a rock and hard space

 

[Anak]

Oh snaps !!! :shock:

Hi Drew,

Although a valid concern, it's not the end of the world. I understand Microsoft is planning a system wide Update to secure for the SSL3 vulnerability in this month's Patch Tuesday (Nov. 11th).

What I would do:

• Talk with your Course Professor's and ask if they are aware of the problem and what are their plans if not only you, but other students in their class can't interact with their courses online.

• Ask if the University has any contingency plans if students can't interact with their courses or the school online. i.e. Time to make a payment$$ or buy new books$$$$.

• Contact St.Leo's IT Dept.. If they don't have one then someone in the Administrative office. Express your concerns and ask them if they have a timeline as to when they will be up to speed with the SSL3 vulnerability.

• Have corroborating evidence if anyone tries to brush off the SSL3 vulnerability as insignificant.

It is convenient for the Professor's, the school, and the students to have online interaction, instead of an onrush of students queuing after class or in the office. It is the University's responsibility to make sure their portal is secure, and accessible to all.

Can you see where I'm going with this? Put the ball squarely in the University's court, and the more students you can garner to put mild pressure on the school and Professor's, should produce action on their part.


Steve

 

[RoasterMen]

FireFox all the way in (Even though it's eating almost 1GB of ram for random reasons)

 

[z3r010]

FireFox all the way in (Even though it's eating almost 1GB of ram for random reasons)

Where did you get such a lightweight version from

 

[sygnus21]

FireFox all the way in (Even though it's eating almost 1GB of ram for random reasons)

Didn't/doesn't Firefox use SSL 3.0 as well??? :sarc:

With that... how does it become a "better" choice in this SSL 3.0 situation?

 

[sygnus21]

Oh snaps !!! :shock:

Hi Drew,

Although a valid concern, it's not the end of the world. I understand Microsoft is planning a system wide Update to secure for the SSL3 vulnerability in this month's Patch Tuesday (Nov. 11th).

(...)

It is convenient for the Professor's, the school, and the students to have online interaction, instead of an onrush of students queuing after class or in the office. It is the University's responsibility to make sure their portal is secure, and accessible to all.

Hi Steve,

You're right of course, but it can be a pain in the arse if the issue isn't resolved soon. Example, while Amazon is warning against SSL 3.0 usage and may not allow SSL 3.0 enabled browsers to do checkouts with them, I also need it enabled to get my school work done because most courses (99 percent) are requiring log in to the school's site for on-line material to include discussion questions as well as exams. Additionally, professors are now requiring that you turn in any and all written papers through the school's Turn-It-In system to fight plagiarism.

Anyway this is a school wide issue, and yes, the university's IT department is aware, but until a fix is secured, who knows how long we'll be stuck with SSL 3.

But as you say, it's not the end of the world so I'll just leave it enabled until it's fixed, hopefully by Patch Tuesday.

Thanks.

 

[A Guy]

Drew, just keep one browser with SSL v3 enabled, and only use that for the one site. A Guy

 

[sygnus21]

Yeah Bill I could do that but I'll just keep using IE and with SSL enabled until the supposed fix. Plus I'm very careful about where I visit so we'll see. If nothing happens by Tuesday I might look at a plan B.

I did a Amazon purchase this evening with SSL and all went well so who knows

Thanks.

 

[RoasterMen]

FireFox all the way in (Even though it's eating almost 1GB of ram for random reasons)

Where did you get such a lightweight version from



View attachment 339565

Woah.

 

[andrew129260]

This flaw needs a few things to be true...

I do want to stress something here (confirmed elsewhere as well):

"Of course, all security flaws like this should be taken seriously, but on the “sky is falling” scale, this seems lower than the other recent big-news vulnerabilities, as it does require an active man-in-the-middle attack — an attacker can’t just probe the web for it or automatically attack a client connecting to a malicious server. (The main risk is when you’re on an untrusted network, like wifi at a cofffeeshop or at a conference.)"

Source: What you need to know about the SSLv3 ?POODLE? flaw (CVE-2014-3566) | Fedora Magazine

What this tells me, and everything I have read about this vulnerability is this would be more devastating for those with laptops connecting to public open wifi (in which case you really should not be going on banking, "secure" websites to begin with) then a desktop sitting at home plugged in by ethernet or a mobile phone using 3g, 4g.


Is the flaw serious? Absolutely.
Should we panic? No.

 

[NoN]

This flaw needs a few things to be true...

I do want to stress something here (confirmed elsewhere as well):

"Of course, all security flaws like this should be taken seriously, but on the “sky is falling” scale, this seems lower than the other recent big-news vulnerabilities, as it does require an active man-in-the-middle attack — an attacker can’t just probe the web for it or automatically attack a client connecting to a malicious server. (The main risk is when you’re on an untrusted network, like wifi at a cofffeeshop or at a conference.)"

Source: What you need to know about the SSLv3 ?POODLE? flaw (CVE-2014-3566) | Fedora Magazine

What this tells me, and everything I have read about this vulnerability is this would be more devastating for those with laptops connecting to public open wifi (in which case you really should not be going on banking, "secure" websites to begin with) then a desktop sitting at home plugged in by ethernet or a mobile phone using 3g, 4g.


Is the flaw serious? Absolutely.
Should we panic? No.

Nobody is spreading panics around here...It is enough hard to dig articles about flaws and security over internet that are hidden or not accessible to end-users.

If Online Sites begin to warn people its that there is a real danger, no matter the level of it.

 

[Anak]

This SSL thing is reminiscent of the Y2K problem, remember how everyone scrambled because they thought the sky was falling?

I agree with Andrew; Is the flaw serious? Absolutely. Should we panic? No; And NoN, To do nothing is as bad as the flaw itself.

FireFox all the way in (Even though it's eating almost 1GB of ram for random reasons)

Didn't/doesn't Firefox use SSL 3.0 as well??? :sarc:

With that... how does it become a "better" choice in this SSL 3.0 situation?

For now yes,

Firefox 34 which is to be released on Nov 25th will have SSL3.0 disabled by default, and follow up with SCSV support in Firefox 35.

Chrome already supports TLS_FALLBACK_SCSV

There is an about:config setting that until the new versions of FF come out, you can modify to stop any SSL3 connections.

FF v33.0 Settings:
Rather than use the FF add-on I set my security.tls.version.min from about:config, the original setting was 0 and I changed it to 3, but had to switch back to 2 because of all places I couldn't reach https://support.mozilla.org

0 means SSL 3.0 and higher is enabled, 1 means TLS 1.0 and higher is enabled, 2 means TLS 1.1, and higher is enabled.

The security.tls.version.max was originally 3 and I left it as is.

I set my tls.version to 2 because I've been seeing reports that TLS1.0 is becoming vulnerable. So far I don't have any problems surfing with FF.

Drew, you're gonna have to sit tight until the University gets things squared away. In the meantime I agree with Bill, only use one browser that's SSL3 compliant for the University's site, and harden another one for casual surfing.


Roaster, with 5tabs open in FF I'm using 0.351GB of RAM (working set).

 

[Callender]

Poodle - how serious is it?

As far I can work out servers can be compromised so to state that the attack requires a MITM attack via compromising a user's browser when using a wifi hotspot would appear to be misleading. it would appear that the attack can take place at the server end.

Security changes in Opera 25; the poodle attacks - Opera Security - Opera Software

If there's more chance of getting struck by lightning than being a poodle attack victim then I wonder why it's Opera decided to remotely disable SSL v3 in user's browsers.

Quote:

Finally, Opera 12 on desktop is taking the lead with disabling SSLv3 support! Since we are not able to apply the countermeasure to all of the remaining Opera 12 installations (and it also does not support TLS_FALLBACK_SCSV), we have remotely turned off SSLv3. This will be automatically distributed to all Opera 12 desktop installations in the next few days. We’re allowing ourselves to be a bit experimental with this, so users who have not yet upgraded to Opera 25 may see more of the broken servers, and we will get some experience in turning off SSLv3. Opera Classic on Android will also be updated in the next coming days.

Security changes in Opera 25; the poodle attacks - Opera Security - Opera Software

 

[Anak]

Callender,

Thank you for the links. I'm gathering information on how to run various browsers in safe mode and they will help in my research.

 

[sygnus21]

If there's more chance of getting struck by lightning than being a poodle attack victim then I wonder why it's Opera decided to remotely disable SSL v3 in user's browsers.

Because people actually do get struck by lightening? :huh:

Opera is simply understanding that lightening could strike.

 

[Callender]

Poodle comment explained

If there's more chance of getting struck by lightning than being a poodle attack victim then I wonder why it's Opera decided to remotely disable SSL v3 in user's browsers.

Because people actually do get struck by lightening? :huh:

Opera is simply understanding that lightening could strike.

Sorry. I'm getting threads confused as there's a few threads that have been started on the issue. I thought that this thread contained this post but obviously it doesn't!

On another note I've just installed a Firefox add on (actually I've installed in Cyberfox 5 minutes ago) and it looks promising:

SSL Sleuth for Firefox

SSL security rated and details displayed along with various options.

Screenshots:

SSL strength rated

​

Option to globally disable RC4

​

Perfect Forward Secrecy displayed

​

Another add on that I plan to try:

Calomel SSL Validation for Firefox

There's a fair amount of information if you scroll down the above link's page.