Disabled SSLv3 in Windows registry but still showing POODLE vulnerability

00fruX

7/25/23, 7:02 PM

Windows server 2016 Standard.

Recently we've been getting hit by brute force attempt using POODLE. I did a little research and found we should disable SSLv3. However, when I go into:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\

...and look at my SSL 3.0 key, I already have both Client and Server folders in there and both have the same two DWORDs: DisabledByDefault (1), and Enabled (0). I must have already done this in the past at one point: https://www.digicert.com/kb/ssl-support/iis-disabling-ssl-v3.htm

If I scan our site using online scanners:

https://www.poodlescan.com POODLE results: SSLv3 enabled

https://www.site24x7.com/ POODLE results: Error occurred while validating SSL3 Poodlebleed Vulnerability for domain

https://ssl-tools.net/ POODLE results: all show TLSv1.2 with SSLv3 crossed out (strikethrough'd)

So. Three different checkers with three different results. Hmmm.

Apparently I'm the only one using Windows and IIS with this issue (every reference I've found here so far is about apache and nginx), so I am posting the question. What more do I need to do to disable SSLv3 and stop this POODLE brute force attempt? This flood of traffic, when it happens, is causing our site to report 503 Service Unavailable every few minutes.

0 + 0

ssl

brute-force-attacks

poodle

Robert

7/25/23, 7:06 PM

What Windows server version do you use?

00fruX

7/25/23, 7:19 PM

Oops. Windows server 2016 Standard.

Robert

7/25/23, 9:29 PM

Poodlescan seems to be defect. No matter which domain I tested according to this site they all have SSLv3 enabled which can't be true.

Score:0

Server

An-dir

7/25/23, 7:29 PM

The following tool makes IIS crypto/SSL/TLS changes easy: https://www.nartac.com/Products/IISCrypto

Try that to validate, but don't forget the checkbox: https://www.ssllabs.com/ssltest/

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Disabled SSLv3 in Windows registry but still showing POODLE vulnerability

TH: ปิดใช้งาน SSLv3 ในรีจิสทรีของ Windows แต่ยังคงแสดงช่องโหว่ POODLE

RO: SSLv3 a fost dezactivat în registrul Windows, dar încă arată vulnerabilitatea POODLE

RU: Отключен SSLv3 в реестре Windows, но по-прежнему отображается уязвимость POODLE

VI: Đã tắt SSLv3 trong sổ đăng ký Windows nhưng vẫn hiển thị lỗ hổng POODLE

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.