POODLE like it’s 1999
Summary: Three Google researchers announced POODLE (Padding Oracle On Downgraded Legacy Encryption), an attack that lets someone already in the network path between client and server decrypt portions of an SSLv3 session, including HTTP cookie data used for authentication. Because browsers fall back to SSLv3 when a TLS connection fails, an attacker controlling the network path can force even two TLS-capable systems onto the vulnerable protocol, and the only permanent fix is disabling SSLv3 entirely.
What you should know: An attacker who can sit in the network path can strip a TLS-capable connection down to SSLv3 and read the authentication cookies inside it, without either endpoint knowing - so the exposure is not limited to the small number of systems that only speak SSL.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026