Just when things got quiet around the infamous Heartbleed bug, a new vulnerability comes around and bites us. The question surely is how hurtful the bite is.
Well, quite a lot. According to security researchers, DROWN, the new vulnerability in question, affects a third of HTTPS websites, or approximately 33% of servers. It has been described as a ‘novel cross protocol attack’ by the group of researchers who disclosed it. Even though the number is not that big when compared to the damage done by Heartbleed, it is still a troublesome one.
Learn More about The Heartbleed Bug
The DROWN Vulnerability Explained: CVE-2016-0800
The very first thing to mention is that the DROWN attack is identified as CVE-2016-0800. At the time this article is being written, no official description is available on cve.mitre.org.
DROWN is indeed a vulnerability in OpenSSL that compromises servers using SSLv2. An attack exploiting the vulnerability ends up with the decryption of the website’s HTTPS communications and the theft of the encrypted data.
What does DROWN mean?
The acronym stands for Decrypting RSA using Obsolete and Weakened eNcryption. It was identified by a team of 15 security experts from several universities.
Why Is DROWN Deployed by Attackers?
Because it can intercept any communication between users and the server and steal sensitive data on the way. What does this mean? Usernames, passwords, credit card numbers, emails, all kinds of documents, instant messages can be stolen. Another outcome of a DROWN attack is attackers impersonating a secure (HTTPS) website and changing the content displayed to the user.
Other Exploits to Keep Away From: Hot Potato
What sites are vulnerable to a DROWN attack?
The list of vulnerable websites https://drownattack.com/top-sites.html is quite big. Hundreds of domains from Alexa Top 10,000 have been deemed vulnerable to MitM (man-in-the-middle) attacks just before the DROWN attack was disclosed to the public on March 1. To sum it up, websites, mail servers, plus TLS-dependent services are prone to a DROWN attack. Unfortunately, many popular sites are at risk of the vulnerability, including Yahoo, Alibaba, Flickr, plus websites of popular security vendors.
Can your website be DROWN-ed?
A DROWN attack is based on TLS (Transport Layer Security). TLS is a protocol that is considered better than SSL (Secure Sockets Layer). However, both TLS and SSL use the same RSA-encrypted session key that generates the HTTPS connection.
What does all that mean?
Servers still using SSLv2 and TLS simultaneously are prone to the exploit, so make sure to disable SSLv2. However, an additional server setup could expose websites to the vulnerability, even in cases when the website only employs TLS.
Here’s what researchers say:
You’re just as much at risk if your site’s certificate or key is used anywhere else on a server that does support SSLv2. Common examples include SMTP, IMAP, and POP mail servers, and secondary HTTPS servers used for specific web applications.
Another great danger comes from the ’recycling’ of RSA keys because the reuse makes servers susceptible to such attacks. For example, your website is at risk, if the admins removed the SSLv2 protocol but did not secure the TLS protocol with new RSA keys.
Read More about The Alarming Reuse of RSA Keys
To make sure your website is not prone to the DROWN attack, use the DROWN checker.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: