This week’s “big hack” everyone is yapping about is the POODLE flaw in Secure Socket Layer (SSL 3.0). The hack is a bad one, when the attacker can get man-in-the-middle to set it up, but the need for MitM does limit the scope of this exploit.
Adding the check for POODLE’s downgrade flag to our NTOSpider scanner was trivial as we already perform SSL Strength Analysis, but the real challenge is how to score this. Quite frankly just allowing SSL 3.0 is inherently bad, and POODLE just makes it worse. I can see an argument for making it high risk to have SSL 3.0 enabled, but then does POODLE make it “Super-High”?
As with my recent post about the 8 lessons learned from Shellshock, I encourage caution with this weekly hype cycle for each new “big hack.” It’s reminiscent of “The Boy Who Cried Wolf” – we’ll see how that will turn out for us.
The post SSL Poodle Check Added to NTOSpider appeared first on Man Vs WebApp.
