Forest Global Training Partners

Cyber Risks · Krebs on Security

‘Poodle’ Bug Returns, Bites Big Bank Sites

Summary: Researchers on Dec. 8 found that the POODLE flaw, first disclosed in mid-October as a vulnerability in SSL 3.0, also extends to certain implementations of TLS, with Qualys estimating about 10 percent of Web servers are vulnerable to the TLS variant. A scan with Qualys's SSL/TLS tool found Bank of America, Chase.com, Citibank, HSBC, Suntrust, Fidelity.com, Vanguard and dozens of Experian-run sites vulnerable, and US-CERT advised disabling SSL 3.0 support as the most viable solution since no fix exists for the protocol itself.

What you should know: The affected institutions are among the largest banks and investment firms in the country, and the attack can expose passwords and session cookies that let an attacker impersonate a legitimate user - while the only remedy US-CERT offers is to turn off SSL 3.0, which some sites still require.

Read the original at Krebs on Security ↗

Topics
Privacy
Related