Chase Online still vulnerable to POODLE for TLS

Like a lot of companies, Chase Online (owned by JP Morgan) uses the F5 BigIP to handle SSL/TLS for its web services. If your web services run on IIS that is a pretty sensible decision but only as long as the F5 is secure. As of the morning of Dec 18,2014 the Chase site is still vulnerable to POODLE for TLS. What make this worthy of a blog post is that there is a patch for the F5 box and it has been available since Dec 8, 2014. I applied it to my employer's machines on Dec 13 and it brought our score on the Qualys SSL tester from an "F" to a much more comfortable "A-".

This will not affect me directly because I don't bank with Chase and I recently canceled my last credit card with them. Still, I think it displays a contemptuous attitude toward customers not to expedite patching such a highly visible system.

Eliminate the Backdoor

Recently, there was a particularly brain-dead editorial in the Washington Post entitled Compromise needed on smartphone encryption.

Changing the name of a deliberately planted security hole from "backdoor" to "secure golden key" doesn't change the essential security problem. Even if you believe that your government can be trusted to never misuse the power of a backdoor, there is someone out there who will find it and use it for unintended purposes. There is no such thing as a "backdoor" that only law enforcement can use.

In 2005 the Ericsson switches used by Vodafone Greece were compromised. Software using the so-called "lawful interception" modules were exploited to intercept phone call from at least 100 government officials for seven months. Interestingly, the Greek Government did not request these modules be activated but they were still used by the, as yet, unidentified attacker.

In 2006 Telecom Italia users were wiretapped via exploits believed, at the time, to have been discovered during a penetration test. The provenance on this exploit is a little fuzzy -- I don't know for certain if it was deliberate backdoor or a programming error -- but it was found and, apparently, exploited.

In 2010 Chinese hackers discovered and exploited a backdoor into the Gmail system placed there by Google to comply with law enforcement intercept orders. The US government mandated that Google give law enforcement access and the Chinese discovered it then used it to gather private data.

Those are just some of the criminal uses of backdoors we know about.

There may be a good argument or two for not revealing an exploit that could be used against an enemy. I can only think of one and it is only passably good. There are, however, no good arguments I know of for deliberately creating a security hole in software -- no matter how much law enforcement wants it.