The “New Normal” seems to be an ever-increasing number of security breaches or cyber attacks. This blog addresses the POODLE (Padding Oracle On Downloaded Legacy Encryption) vulnerability that surfaced last month. The purpose of the blog is to help you understand this vulnerability and to let you know how Cyara has responded.
What is POODLE?
On October 14, 2014, Google security researchers released details of a vulnerability within the design of the SSL version 3 protocol. This vulnerability could enable an attacker in an administrative position on a network to intercept encrypted traffic and methodically decrypt the messages to reveal sensitive information such as credentials. This is an industry-wide issue, affecting nearly every system that implements or supports the SSL protocol.
Despite the widespread use of SSL, security researchers have stated that POODLE is potentially less harmful than other threats that have occurred in recent months. One reason for this is that Transport Layer Security, or TLS, has largely replaced SSL 3.0. Also, to pull off a POODLE attack, the victim has to be actively online and physically close to the attacker — say, using the same public Wi-Fi network.
Cyara’s Response to the Threat
Cyara has taken swift action to address POODLE vulnerability. Cyara experts proactively tackle the latest security threats on a daily basis, and they regularly consult the latest security information from global experts. While POODLE was not introduced by Cyara software, we recognize that this bug is widely present in the software industry as a part of the still common SSLv3 protocol. The specific actions taken by Cyara are detailed below.
Cloud Customers:
Cyara has taken the necessary steps to disable SSLv3 on all of our cloud platforms (www.cyaraportal.us; www.cyaraportal.co.uk; www.cyaraportal.com). These platforms now support only Transport Layer Service (TLS), which is not susceptible to this vulnerability.
Premises Customers:
Cyara is proactively reaching out to customers who are using an on-premises version of the Cyara platform to assist them with specific tasks to reduce vulnerability.
At Cyara, our customers are our most important assets. We will continue to closely monitor vulnerabilities that are discovered, and to keep you informed. If you have any further questions or concerns regarding the POODLE vulnerability, please contact your account representative or the Cyara Support Team.
Thank you for being a valued Cyara customer.
