4

Hi just checked my 1320 need a fix for Poodle. Is an update available?

I used https://www.poodletest.com/ and found that IE is vulnerable to SSL 3.0 attacks. I think a fix is much needed as mobiles devices are used on public networks and more prone to this hack.

Improve this question
2
  • I've been disabling SSLv3 for the last 5 or 6 years because of all the problems (SSLV3 problems have been well know since at least 2006, and some even prior). Its sad that these phone manufacturers still allow SSLv3, and worse that they don't give the user a choice. – user9341 Oct 18 '14 at 15:41
  • It also affects the email client, with no support for TLS (only SSLv4) for IMAP and SMTP servers – Daniel Symonds-Lloyd Oct 19 '14 at 11:42
1

There are registry values which will disable SSL3 (or other SSL/TLS versions). See this thread on XDA-Developers for the change to make (in the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings registry key, create/set the SecureProtocols value to DWORD 2688 or 0xA80 if your editor app wants hex).

In order to do this, you will need a working registry editor app. There is one available for Lumias (though you'll need an SD card in order to install it) here: http://forum.xda-developers.com/windows-phone-8/development/xap-vcreg-lumia-reg-editor-live-interop-t3135326

I like to use this kind of thing as an example of why Microsoft's policy of locking users out of the ability to control their own devices is a bad and harmful policy. I had my phone protected against POODLE within a few days of its publication. Meanwhile, those who won't or cant interop-unlock their phones are stuck with the vulnerability until Microsoft releases a patch (apparently 8.1u2 makes you safe, but most phones never got that one).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.