The Latest Big Cyber-Threat: Are Your Servers “DROWN-proof”?
March 30th, 2016 by admin
If you think there's a new cyber-threat to worry about every week, you're probably right. The latest vulnerability to send shockwaves through the enterprise security community has been given a rather ominous acronym: DROWN, short for Decrypting RSA with Obsolete and Weakened eNcryption.
Publicized just a few weeks ago by an international team of security researchers, DROWN exploits outdated encryption methods to intercept confidential data from as many as one-third of the HTTPS servers around the world—from those of popular public websites (including Yahoo, CNBC.com, AutoTrader, and more) to private servers hosting email, instant messaging, and other essential online services.
Yesterday's Security, Today's Danger
The basis of DROWN is Secure Socket Layer version 2 (SSLv2), an early Internet encryption protocol. As public Internet usage exploded in mid-'90s, SSLv2 was an early attempt to protect passwords, credit card numbers, and other sensitive data transmitted over the web. But the initial SSLv2 quickly revealed multiple security weaknesses—and proved quite "hackable"—before being largely replaced after only a few years by today's cryptographic standard, Transport Layer Security (TLS).
Two decades later, obsolete SSLv2 is considered "ancient history" and no longer supported by most end-point browsers or client software (the apps your computer is using to access the web and send/receive email). Yet it remains supported by many servers as a means of backwards compatibility—even though it's increasingly unlikely that a newer computer would attempt to "communicate" via the obsolete protocol.
Left ignored and mostly forgotten, SSLv2 became the perfect vehicle for a "cross-protocol" DROWN attack.
A Hacker's Dream: Quick and Cheap
Without getting too far into the confusing technical details, the DROWN researchers proved that by exploiting the weaknesses in alternative SSLv2 connections, a TLS server connection (or "handshake") could be successfully decrypted in under 8 hours. The process involves comparing about 40,000 "probe" connections against an extreme amount of offline computations (250). But with the current availability of cheaper Cloud-based high-capacity computing services as Amazon EC2, it could be accomplished by a skilled hacker for as little as $440.
The good news is that as of now, there are no reported cases of actual DROWN attacks "in the wild"—but the prime role of cyber-security is to uncover new threats before the crooks stumble upon them. In the meantime, the best defense against DROWN is to disable SSLv2 connections from web servers as well as all STMP, IMAP, and POP email servers. The DROWN research team has included specific details in their website, which can be seen here.
Longtime readers of our blog know that defending your company from cyber-attacks is now simply part of the cost of doing business. To learn more about the DROWN vulnerability and protection from other emerging threats, contact us today.