So this week gave us two things: Apple's big glass-and-aluminum event with the new iPads and that gorgeous 5K iMac (more on that maybe later, I need to actually see one in person before I decide if its worth the money), and something a lot less shiny that actually made me lose an evening — POODLE.
If you run any kind of server that still accepts SSLv3 connections, you probably already got the memo, but for anyone who hasn't caught up yet: Google's security team (Bodo Möller and a couple of colleagues) published details on October 14th about a padding oracle vulnerability in SSL 3.0. The acronym is POODLE, which stands for "Padding Oracle On Downgraded Legacy Encryption," and yes, someone clearly worked backwards from the dog pun. The short version is that an attacker who can sit on your network (open wifi at a coffee shop, say) can trick a browser and server into falling back to the ancient SSLv3 protocol and then chip away at encrypted cookies a byte at a time. Its not a "your site is instantly compromised" bug, but its bad enough that the only real fix is to stop supporting SSLv3 at all.
I found out about this the annoying way, which is to say I ran this blog through Qualys' SSL Labs test on a whim Wednesday night (I do this every few months, dont ask me why, its basically a compulsion at this point) and watched my grade drop to a C. That got my attention fast.
What I actually did to fix it
I'm running nginx on a DigitalOcean droplet, so this was a config change rather than anything dramatic. If you're in the same boat, the fix is to explicitly list the protocols you allow and just leave SSLv3 off the list entirely:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
That one line in your server block (inside /etc/nginx/nginx.conf or wherever your ssl settings live) tells nginx to refuse to negotiate SSLv3 at all. Reload nginx (sudo service nginx reload, no need for a full restart) and you're basically done. Apache folks want SSLProtocol all -SSLv2 -SSLv3 in their config instead. Either way, run the Qualys test again afterward to confirm — mine came back to an A minus, which I'll take.
The one wrinkle, and this is the part that actually matters for anyone running a site with real traffic: turning off SSLv3 will break connections from genuinely ancient clients. We're talking Internet Explorer 6 on Windows XP, mostly. For a personal blog like this one, I don't lose a second of sleep over that. If you're running something for a business that still has to support IE6 for some cursed internal reason, this is going to be a harder conversation, and I don't envy you having it.
Browser-side, Firefox and Chrome both pushed out updates within days that disable SSLv3 fallback by default, which is honestly the better long-term fix since it doesn't rely on every server admin on earth reading a security advisory and acting on it before someone with a packet sniffer gets to them first. Server-side mitigation is a stopgap. The real fix is the entire internet finally being allowed to let SSLv3 die, seventeen years after it shipped. Nobody should be sad about this. Its 2014. TLS 1.2 has been around since 2008 and plenty of servers still werent using it as a floor.
Small tangent, but it bugs me every time this happens: this is like the third "drop an old crypto protocol" scramble I've patched around on this very server since I started this blog back in 2011, and each time the actual fix takes ten minutes and the reading-about-it-and-getting-anxious part takes an hour. I really should just set a calendar reminder to run the SSL Labs test monthly instead of whenever the mood strikes.
Anyway. If you haven't checked your own site yet, go run it through the Qualys test right now, it takes about ninety seconds and it's free. Better to know tonight than to find out from someone else's exploit later.