A new bug in the security software that underpins the web has been found by security researchers from Google.

The vulnerability nicknamed “Poodle” is a hole in the design of the third version of the secure sockets layer (SSL), a technology which encrypts data sent between users and servers. Researchers say the flaw allows attackers to decrypt and steal the data.

The bug only affects the SSL 3.0 software, which was first published in 1996, but was quickly replaced by the more secure transport layer security (TLS) in 1999.

‘Nearly all browsers support SSL 3.0’

Despite being nearly 18 years old, SSL 3.0’s use is widespread, although updated sites with the newer security software versions are immune, unlike the Heartbleed bug that affected two-thirds of the internet in April.

“Most importantly, nearly all browsers support SSL 3.0 and, in order to work around bugs in HTTPS servers, browsers will retry failed connections with older protocol versions, including SSL 3.0,” said Bodo Möller a member of Google’s security team in a blog post. “Because a network attacker can cause connection failures, they can trigger the use of SSL 3.0 and then exploit this issue.”

Hackers can steal information using the Poodle bug in a relatively simple manner, but it is a “man-in-the-middle attack” that requires the hacker to tap into the connection between users and servers. It means most will be safe while browsing at home, but could be vulnerable while browsing the internet using public Wi-Fi hotspots.

There is no evidence that the bug has yet been used to access consumer information, but it could theoretically be used to intercept a log in to a web-based service and access someone’s account.

‘This should be an academic curiosity’

Poodle is the latest in a long string of bugs found in crucial components of the internet, first brought into the spotlight by the Heartbleed bug in April, then Shellshock in September. It is similar to a few other more obscure vulnerabilities, but is more practical to implement in an attack.

Websites using SSL 3.0 will need to be updated to prevent exploitation of the bug. Most already use stronger, more modern security standards, but removing SSL 3.0 will render some older browsers and software including Internet Explorer 6 and Windows XP incompatible.

Newer browsers, including later versions of Internet Explorer, Google Chrome, Firefox and Apple’s Safari will continue to work without SSL 3.0.

“This should be an academic curiosity because SSLv3 was deprecated very nearly 15 years ago,” said Adam Langley, one of the Google security team that discovered the bug. “However, the internet is vast and full of bugs.”

“The vastness means that a non-trivial number of SSLv3 servers still exist and workarounds for the bugs mean that an attacker can convince a browser to use SSLv3 even when both the browser and server support a more recent version. Thus, this attack is widely applicable,” he said.

“Heartbleed and Shellshock allowed hacks against servers (meaning websites and such),” explained Robert Graham owner offensive security firm Errata Security. “Poodle allows hacking clients (your web browser and such). If Hearbleed/Shellshock merited a 10, then this attack is only around a 5.”

“What the hacker will likely try to do is hack your session cookies. That means they won’t get your password for your account, but they will be able to log in as you into your account,” Graham said.

Internet firms have been quick to act. CloudFlare, which hosts and protects thousands of websites, message service Slack, search engine DuckDuckGo, Fitbit, Twitter and many others have already disabled support for SSL 3.0.

• What is the Shellshock bug? Is it worse than Heartbleed?