Identified as a low cost attack, DROWN allows hackers to decrypt browser-server communication in hours to attack servers or/and users. Shockingly, this newly found vulnerability works even on TLS servers, and affects yahoo.com, alibaba.com, buzzfeed.com, flickr.com, and cnbc.com to name a few.
DROWN vulnerability and affected website list was publicly disclosed on March 1, 2016, still many websites have failed to secure their primary and subdomains. Roughly, 11 million email servers and websites were vulnerable to this attack on March 1.
Decrypting RSA with Obsolete and Weakened eNcryption (DROWN) is a vulnerability discovered in OpenSSL that allows attackers to decrypt secure HTTPS browser to server communication.
Researchers from Münster University of Applied Sciences, Department of Electrical Engineering, Horst Görtz Institute for IT security, Tel Aviv University, Ruhr University Bochum, Hashcat Project, University of Pennsylvania, University of Michigan Google/OpenSSL, and Two Sigma/OpenSSL uncovered the vulnerability.
Notably, DROWN attack targets SSLv2, an old and deprecated encryption protocol. SSLv2 had a reputation of being badly insecure even in the 90s and was soon discarded to secure user to server communications. Even though most of the modern day web servers and websites do not use the TLS encryption protocol, many servers can still support SSLv2 due to default settings and misconfiguration.
Hijacking the user to browser communication means that attackers can get their hands on whatever is being sent. This includes documents, instant messages, emails, credit card numbers, passwords, usernames, and other sensitive information.
However, the exploitation risks are not limited to stealing sensitive information. Attackers can use it to reach the website server or impersonate secure website or messages to users.
If your server allows SSLv2 connections and is not protected by web application firewall, it is vulnerable to DROWN attacks. While administrators are certain of discarding support for SSLv2, they might be unaware of default setting issues and other misconfigurations.
You can test the IP or domain here: Check for DROWN Vulnerability
Please note that hackers can also exploit DROWN even if you allow private keys on any other server that might support SSLv2. This is extremely critical for email service providers, who often use the same cert on their email and web servers.
AppTrana will also flag servers that are vulnerable to the DROWN attack.
Ideally, server operators and administrators should look for misconfigurations that allow SSLv2 support and terminate it immediately. However, it is a complicated process and might take days to find the configuration and default setting error. OpenSSL recommends upgrading to the most recent OpenSSL version.
As informed to our customers, AppTrana Web Application Firewall (WAF) services are not impacted since SSLv2 is not enabled on our WAF solution. There is no way a man in the middle can access your RSA keys.
Find out more about Indusface Web Application Firewall and how it prevents zero-day vulnerability attacks here.
Founder & Chief Marketing Officer, Indusface
Venky has played multiple roles within Indusface for the past 6 years. Prior to this, as the CTO @indusface, Venky built the product/service offering and technology team from scratch, and grew it from ideation to getting initial customers with a proven/validated business model poised for scale. Before joining Indusface, Venky had 10+ years of experience in security industry and had held various mgmt/leadership roles in Product Development, Professional Services and Sales @Entrust.