Skip to main content

PhantomJS / POODLE

On Tuesday October 14th, 2014, Google announced the POODLE vulnerability for SSLv3. Engineering teams scrambled to remove support for SSLv3 on their websites, including our own system operations team.

My team's data engineering system scrapes information from retail banking sites, which we have learned were heavily impacted by the SSL fix on Tuesday. It makes sense that banks would want to keep up-to-date with the latest security issues.

When we scraped pages on Wednesday morning, a large portion of the sites we collect from came up blank in the PhantomJS browser, but without any obvious errors in our log files or in our log analysis dashboard (Kibana).

We were puzzled at this behavior, and when we went to look at the URL's that failed to produce images, it was clear that they were all SSL-enabled and responding with a recent TLS protocol. It turns out that PhantomJS by default only uses the SSLv3 protocol, and so it does not support any of the TLS protocols without additional configuration.

The solution to our problem was to set the command line flag for preferred SSL protocol to any so PhantomJS is free to pick whatever protocol is supported by the site being scraped. While it is unintuitive for PhantomJS to select the least secure protocol as the default, at least we can override it easily.
Labels:

Comments

Post a Comment

Popular posts from this blog

ReactJS, NPM and Maven

I'm just starting to get into working with ReactJS, Facebook's open source rendering framework. My project uses SpringBoot for annotation-driven dependency injection and MVC. I thought it would be great if I could use a bit of ReactJS to enhance the application. If you're looking for a basic conceptual intro, I recommend ReactJS for Stupid People and of course the official documentation  is quite good. In full disclosure, I still have no idea how to do "flux" yet. As an experienced Java backend developer, I'm pretty decent at hacking Maven builds - which is precisely what this blog post is going to be about. First, a word about how React likes to be built. Like many front-end tools, there is a toolkit for the node package manager (NPM). From the command prompt, one might run npm install -g react-tools  which installs the jsx command. The  jsx  command provides the ability to transform JSX syntax into ordinary JavaScript, which is precisely what I want...
24 comments
Read more

Solved: Unable to Locate Spring Namespace Handler

I attempted to run a Spring WebMVC application, and when starting up the application complained that it didn't know how to handle the MVC namespace in my XML configuration. The project runs JDK 7 and Spring 4.0.6 using Maven as the build system. The following is my XML configuration file: <?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans"        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"        xmlns:mvc="http://www.springframework.org/schema/mvc"        xsi:schemaLocation="         http://www.springframework.org/schema/beans         http://www.springframework.org/schema/beans/spring-beans.xsd         http://www.springframework.org/schema/mvc         http://www.springframework.org/schema/mvc/spring-mvc.xsd">          <mvc:annotation-driven/> ...
1 comment
Read more

Parsing HTML with JSoup

The transit demo site I'm building uses data from several websites - such as the Port Authority's press page. Unfortunately, most sites aren't designed for easy parsing; usually data is only available as HTML. So I need to parse HTML to uncover useful information, and if you've ever looked at the source of an average web page, writing a parser from scratch is a challenging task. Enter the jsoup library. This programming interface exposes the structure of a HTML document in a way that can be queried, traversed and even altered by Java programs. I had previously used it to clean out HTML tags from user-submitted content, but recently have been taking advantage of its powerful query engine, which is similar to the way jQuery selectors operate. Let's say I'm parsing some markup that repeats for different stories: I would want to parse this by first finding all of the stories using the <div class="story"> element, and then for each story, quer...
Post a Comment
Read more