SSL broken, again, in POODLE attack
|
The attack depends on the fact that most Web servers and Web browsers allow the use of the ancient SSL version 3 protocol to secure their communications. Although SSL has been superseded by Transport Layer Security, it's still widely supported on both servers and clients alike and is still required for compatibility with Internet Explorer 6. SSLv3, unlike TLS 1.0 or newer, omits validation of certain pieces of data that accompany each message. Attackers can use this weakness to decipher an individual byte and time of the encrypted data, and in so doing, extract the plain text of the message byte by byte.
As with previous attacks of this kind against SSL, the most vulnerable application is HTTP. An example attack scenario would work something like this. ...
|
|
Full Story |
This topic does not have any threads posted yet!
You cannot post until you login.
