How do I disable SSLv3 in Safari (OSX & iOS)

Long Wu Yuan wrote:

Sense does not prevail ;

You must be a Registered Apple Developer to file bugs via Bug Reporter.

That's one of the reasons I registered many years ago. You can still do that for free. Just requires a bit of time to fill in the blanks and there you are. Imagine what chaos there would be if they took anonymous bug reports.

Bugs come from users, not developers.

Long Wu Yuan wrote:

Bugs come from users, not developers.

Most, but not all.

I'm not a developer in any sense of the word, just registered as one which they freely allow. Real developers pay $99/year for the support they receive. I get free access to many of the tools, BugReporter and can read but not write to selected sections of the Developer Forum. I find this to be very advantageous in my work as a user.

Instead of disabling SSLv3, we have to do this talk. Better to not talk and find sense.

Finally got a "reply" from my CU basically saying nothing other than they are moving to TLS 1.0. I know you've both mentioned that the latest version is 1.2, but this IT department is only now leaving SSL, so I have to be thankful for whatever improvements I can get! ;-) My understanding is that TLS 1.0 would be acceptable even if the browser is capable of using 1.2. I've now left a voicemail message which will probably come while I'm not at home and/or my iPhone is dead. 😮 We can only hope.

These security protocols are completely beyond my knowledge. This thread has been somewhat helpful, thanks.

My only conclusion, from looking at the CU web page is that it is NOT seeing Safari as unacceptable or unsupported. They obviously have no idea that there are any Mac users of their site, but there is a comment line in the html that says, "<!-- alt code for unsupported browsers //-->". Since Safari does NOT use the link in the next line, I might assume that a javascript variable has NOT been set to note that the browser is "unsupported".

Unfortunately, that 'assumption' is probably overly generous since the link only displays a page suggesting the user needs a browser that can use 128K encryption. Safari has had that capability for several years, AFAIK. Nor does the page address the POODLE SSL concern even generally. It simply listed four browsers, Chrome, IE, Firefox, and Safari. So, the term "unsupported" may not apply to anything other than encryption. I cannot assume that Safari is still in that list because anyone has 'approved/verified' POODLE protection. It is very likely just lax updating of the web site. 😕

Hopefully, I can talk to some one who is both knowledgeable and able to talk to a non-techy! Later...

Amazingly, I got a call from the staff at the CU! Unfortunately, he was not able to confirm the suitability of Apple's "fix". The security part of the CU site is handled by a third-party company and while they have said Safari is now Poodle-proof, they haven't, yet, been able to explain how they determined that. The individual I talked to said he has filed a ticket asking for more positive confirmation from that company. He mentioned that the CU is currently researching their suitability of renewing a contract with that company, whether that was mentioned in that ticket is doubtful, of course. 😉 That is where he has a little more leverage than a mere customer of Apple in getting a response! He did promise to let me know whatever he finds out. Hopefully, this company and Apple have a more direct line of communication and some equally qualified employees. My opinion is that the best I/we can do is to make bug reports through the Developer site.

OK, guys, what does this mean? 😝

From Security Update 2015-001 1.0 (Note: the "1.0" is seen in the label for this update in my Mavericks iMac. It is not shown anywhere on the page linked to in SU! <>):

OpenSSL

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1

Impact: Multiple vulnerabilities in OpenSSL 0.9.8za, including one that may allow an attacker to downgrade connections to use weaker cipher-suites in applications using the library

Description: Multiple vulnerabilities existed in OpenSSL 0.9.8za. These issues were addressed by updating OpenSSL to version 0.9.8zc.

And this from https://www.openssl.org/news/vulnerabilities.html:

15th October 2014

OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications to block the ability for a MITM attacker to force a protocol downgrade. Some client applications (such as browsers) will reconnect using a downgraded protocol to work around interoperability bugs in older servers. This could be exploited by an active man-in-the-middle to downgrade connections to SSL 3.0 even if both sides of the connection support higher protocols. SSL 3.0 contains a number of weaknesses including POODLE(CVE-2014-3566). See also https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00 and https://www.openssl.org/~bodo/ssl-poodle.pdf

Fixed in OpenSSL 1.0.1j (Affected 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1) Fixed in OpenSSL 1.0.0o (Affected 1.0.0n, 1.0.0m, 1.0.0l, 1.0.0k, 1.0.0j, 1.0.0i, 1.0.0g, 1.0.0f, 1.0.0e, 1.0.0d, 1.0.0c, 1.0.0b, 1.0.0a, 1.0.0)

->Fixed in OpenSSL 0.9.8zc (Affected 0.9.8zb, 0.9.8za, 0.9.8y, 0.9.8x, 0.9.8w, 0.9.8v, 0.9.8u, 0.9.8t, 0.9.8s, 0.9.8r, 0.9.8q, 0.9.8p, 0.9.8o, 0.9.8n, 0.9.8m, 0.9.8l, 0.9.8k, 0.9.8j, 0.9.8i, 0.9.8h, 0.9.8g, 0.9.8f, 0.9.8e, 0.9.8d, 0.9.8c, 0.9.8b, 0.9.8a, 0.9.8)

As long as we get no answer from Apple about the Safari vulnerability to Poodle, I'm using, on my iPad, Google Chrome as a second browser. In that way, I can connect to any exotic website in safe way.

And how did you disable SSLx in those browsers? 😉

xairbusdriver wrote:

And how did you disable SSLx in those browsers? 😉

Apparently there is no need to as the developers don't allow the use of SSL.

I use this rule on my Linux firewall to prevent ANY browser from negotiating an SSLv3 connection. It is disheartening to STILL not see any official response from Apple explaining why Safari to is still able to establish SSLv3 connections while they claim that the POODLE vulnerability is fixed, though all my observations and tests indicate it was not as of my last tests.

# Block all external outbound SSL3 traffic

iptables -I FORWARD 1 -o eth1 -p tcp \! -f --dport 443 -m state --state ESTABLISHED -m u32 --u32 "0x33&0xFFFFFF=0x160300" -j REJECT

Here is a NSA report, fully describing the situation of today with SSL obsolescence:

https://www.nsa.gov/ia/_files/app/ssl_and_tls_tech_report.pdf

Thanks. Still not completely clear to me, especially with regard to Mavericks Safari.

Pragmatic solution from the Swiss centre MELANI: use currently more than one single browser:

http://www.melani.admin.ch/themen/00166/01567/index.html?lang=en