Bitdefender Antivirus 2015 - Ssl Scanning - Poodle

Gattaca · December 2014

Title says it all. In order to make SSL browsing secure again, you need to switch of SSL scanning as it seems that BD opens up a unsecure SSLv3 connection instead of at least TLS 1.0.

Gattaca · December 2014

My fault - after setting the browsers right it worked.

bitter150 · February 2015

I am not shure...

If 'Scan SSL' in Privacy control settings is set to OFF, poddle attack isn't working.

If 'Scan SSL' in Privacy control settings is set to ON, poddle attack is possible!

S it seems that BD-IS (2014) is connecting as MITM with unsecure protocol SSLv3...

Testsite https://www.poodletest.com/

FF browser settings in about:config is set to security.tls.version.min = 1.

bitter150 · April 2015

I am sorry, but version 18.22 did NOT solve existing security leak with Scan-SSL feature in Webprotection!

Weak cipher algos are still included, pls refer to attached screenshot and:

https://www.ssllabs.com/ssltest/viewMyClient.html

TLS_RSA_WITH_RC4_128_MD5

TLS_RSA_WITH_RC4_128_SHA

You can check unsecure results with Scan-SSL activated also at:

https://www.poodletest.com/

https://zmap.io/sslv3/

There are threads going on in BD forum too:

http://forum.bitdefender.com/index.php?showtopic=54866

and some more...

Activating Scan-SSL feature breaks secure browser encryption by replacing it with unsecure cipher algos by BD web protection!

Bitdefender Antivirus 2015 - Ssl Scanning - Poodle

Comments

All Time Leaders

Categories

Defenders of the month