title: Disable SSL fallback and use only TLS for outbound connections in .NET? (Poodle mitigation)
body: <p>I am trying to mitigate our vulnerability to the <a href="https://www.openssl.org/~bodo/ssl-poodle.pdf" rel="noreferrer">Poodle SSL 3.0 Fallback</a> attack. Our admins have already started disabling SSL in favor of TLS for inbound connections to our servers. And we have also advised our team to disable SSL in their web browsers. I'm now looking at our .NET codebase, which initiates HTTPS connections with various services through <a href="http://msdn.microsoft.com/en-us/library/system.net.httpwebrequest(v=vs.110).aspx" rel="noreferrer">System.Net.HttpWebRequest</a>. I believe that these connections could be vulnerable to a MITM attack if they allow fallback from TLS to SSL. Here is what I have determined so far. Could some one please double-check this to verify that I am right? This vulnerability is brand new, so I have yet to see any guidance from Microsoft on how to mitigate it in .NET:</p>
  
  <ol>
  <li><p>The allowed protocols for the System.Net.Security.SslStream class, which underpins secure communication in .NET, are set globally for each AppDomain via the <strong>System.Net.ServicePointManager.SecurityProtocol</strong> property.</p></li>
  <li><p>The default value of this property in .NET 4.5 is <code>Ssl3 | Tls</code> (although I can't find documentation to back that up.) SecurityProtocolType is an enum with the Flags attribute, so it's a bitwise <em>OR</em> of those two values. You can check this in your environment with this line of code: </p>
  
  <p><strong>Console.WriteLine(System.Net.ServicePointManager.SecurityProtocol.ToString());</strong></p></li>
  <li><p>This should be changed to just <code>Tls</code>, or perhaps <code>Tls12</code>, before you initiate any connections in your app:</p>
  
  <p><strong>System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls;</strong></p></li>
  <li><p><strong>Important:</strong> Since the property supports multiple bitwise flags, I assume that the SslStream will <strong>not</strong> automatically fallback to other unspecified protocols during handshake. Otherwise, what would be the point of supporting multiple flags?</p></li>
  </ol>
  
  <p><strong>Update on TLS 1.0 vs 1.1/1.2:</strong></p>
  
  <p>According to Google security expert Adam Langley, <a href="https://www.imperialviolet.org/2014/12/08/poodleagain.html" rel="noreferrer">TLS 1.0 was later found to be vulnerable to POODLE if not implemented correctly</a>, so you should consider moving to TLS 1.2 exclusively.</p>
  
  <p><strong>Update for .NET Framework 4.7 and above:</strong></p>
  
  <p>As alluded to by <a href="https://stackoverflow.com/a/35851145">Prof Von Lemongargle</a> below, starting with version 4.7 of the .NET Framework, there is no need to use this hack as the default setting will allow the OS to choose the most secure TLS protocol version. See <a href="https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls" rel="noreferrer">Transport Layer Security (TLS) best practices with the .NET Framework</a> for more information.</p>