New security vulnerability after Heartbleed has been discovered on the protocol. It is named as POODLE. Poodle stands for Padding Oracle on Downgraded Legacy Encryption which is used by the hackers for encrypting web traffic. It was discovered by Thai Doung, Krzysztof Kotowicz and Bodo Moller. All of them are security researchers at Google. They also published details about this vulnerability in the form of a paper today.
It attacks directly on the Secure Sockets Layer protocol and encrypt the traffic between the mail server and email client used by the user or else between a website and a browser. It is not as much intense as the Shellshock or Heartbleed but it enables the attacker to hijack and decrypt the session cookie which is meant to determine you as a user for Google or twitter and it does not even needs your password for that.
As the matter of facts POODLE can affect only SSLv3 so the security administrators at Google recommended all systems administrators to simply turn off support for SSLv3 to protect yourself against the issue.
Rob Graham, CEO of Erratasec said that, “This attack is really against clients, you have to worry about it if you’re in a place like Starbucks. If you’re at home there’s probably no one man-in-the-middling you except the NSA. So as a home user, you don’t need to panic. As a server administrator, you probably don’t need to panic if your customers are coming in over home connections. Only if they are coming in something like a Starbucks Wi-Fi.”
Heartbleed and Shellshock were vulnerabilities that allowed an attacker to hack a server. POODLE instead targets the clients.
“The fear of rushing to go fix this is very low because of that,” Graham says. “People with servers can’t get hacked, and people with [vulnerable] clients also can’t get hacked unless they’re on an open Wi-Fi.”