SSLv3 Poodle Vulnerability | Password theft

All systems and applications utilizing the Secure Socket Layer (SSL) 3.0 with cipher-block chaining (CBC) mode ciphers may be vulnerable. However, the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack demonstrates this vulnerability using web browsers and web servers, which is one of the most likely exploitation scenarios.

Some Transport Layer Security (TLS) implementations are also vulnerable to the POODLE attack.

The POODLE attack can be used against any system or application that supports SSL 3.0 with CBC mode ciphers. This affects most current browsers and websites, but also includes any software that either references a vulnerable SSL/TLS library (e.g. OpenSSL) or implements the SSL/TLS protocol suite itself. By exploiting this vulnerability in a likely web-based scenario, an attacker can gain access to sensitive data passed within the encrypted web session, such as passwords, cookies and other authentication tokens that can then be used to gain more complete access to a website (impersonating that user, accessing database content, etc.).

Subscribe and share!

[heyjoeway]

This is the only explanation that's made sense to me so far. I think the only thing that was glossed over was how you know the value of the last byte: by manipulating the length of the message, it can be pushed further and further until a new block is required, at which point you know that last byte has to be the maximum for the given block size. Once you know that, it's game over.

[alejandrorodriguez]

How the attacker knows the padding value
the only thing he sees is the encrypted text

[bravefinger]

dude, do you allowme to use your video and information for my assignment?

[abhijeetshirsat]

Very nicely explained.. Enjoyed the learning...