The Poodle attack (Padding Oracle On Downgraded Legacy Encryption) relied on TLS implementations that failed to respond to requests from clients with new TLS versions. They then assumed that the server did not speak TLS at all and switched to the totally obsolete and vulnerable SSLv3. Attackers simply let TLS connections crash into the wall and cheered when the client dug out SSLv3.

Heartbleed was also an implementation error. It gave attackers the ability to read 64KB of the server's RAM – multiple times in succession – thus allowing certificate keys to fall into the wrong hands. Bruce Schneier said at the time that, on a scale of 1 to 10, this was a category 11 disaster [1].

Administrators can avoid all of this pain by keeping the TLS implementations on their servers up to date. But, what if you are forced to run applications that do not even support the latest TLS versions? True to the adage of "Never change a running system," many people stubbornly stick with Apache 2.2, or other services that are of value only to archaeologists.

Catcher on the Rocks

TLS Interposer is the answer for these notorious underminers of web security. It is activated by the LD_PRELOAD mechanism and fields API calls to the OpenSSL library. Many distributions include it in their repositories, but you can also download from GitHub [2]. After unpacking, just type

make && sudo make install

Apart from the compiler itself, you need the OpenSSL development package. This typically goes by the name libssl-dev or something of that ilk. Once the compiler has completed its work, you should have a file named libtlsinterposer.so.

Everything else is simple. Just make sure the service sees the LD_PRELOAD environmental variable with the path to the libtlsinterposer.so you just compiled. For Apache 2.2, for example, you would open /etc/apache/envvars and add

export LD_PRELOAD=/usr/local/\
  tlsinterposer/libtlsinterposer.so

After restarting the HTTP daemon, the venerable Apache then communicates with the latest TLS. You might also want to test the setup with SSLScan [3] or one of the many online services that offer a similar scan, such as the Qualys SSL Server Test [4].