⬇ Download holy card: ·
Saint PoodleBleed, Who Brought SSL 3.0 Back
Patron of old SSL versions, protocol downgrades, and badly groomed poodles.
Life
On 20 September 2014 Bodo Möller, Thai Duong and Krzysztof Kotowicz of Google revealed POODLE, an attack on venerable SSL 3.0. By forcing a connection to downgrade to that protocol and exploiting CBC padding, an attacker could decrypt sensitive data such as session cookies one byte at a time. A variant also hit some TLS implementations that reused the old code.
Prayer
O Saint PoodleBleed, who bring back to life the protocols we thought buried, let our servers refuse SSL 3.0 for ever. Amen.
How to celebrate
Celebrated by disabling SSL 3.0 everywhere and enabling TLS_FALLBACK_SCSV against downgrades.
An old protocol never buried will bite again sooner or later.