Jump to content

DROWN attack

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Amritchhetrib (talk | contribs) at 06:00, 6 May 2016. The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

"DROWN" redirects here. For other uses, see Drown (disambiguation).
Broken lock logo symbolizing DROWN attack

The DROWN attack is a cross-protocol security bug that attacks servers supporting modern TLS protocol suites by using their support for the obsolete, insecure, SSL v2 protocol to leverage an attack on connections using up-to-date protocols that would otherwise be secure.[1][2] DROWN can affect all types of servers that offer services encrypted with TLS yet still support SSLv2, provided they share the same public key credentials between the two protocols.[3] Additionally, if the same public key certificate is used on a different server that supports SSLv2, the TLS server is also vulnerable due to the SSLv2 server leaking key information that can be used against the TLS server.[4]

Full details of DROWN were announced in March 2016, together with a partial patch for the exploit; the vulnerability was assigned the CVE ID CVE-2016-0800.[5] The patch alone will not be sufficient to mitigate the attack if the certificate can be found on another SSLv2 host. Use of SSL V3.0 is of the countermeasures against this attack.

The researchers estimated that 33% of all HTTPS sites were affected by this vulnerability as of March 1, 2016.[6]

Details

DROWN is an acronym for "Decrypting RSA with Obsolete and Weakened eNcryption".[7] It exploits a vulnerability in the combination of protocols used and the configuration of the server, rather than any specific implementation error. According to the discoverers, the exploit cannot be fixed by making changes to client software such as web browsers.[8]

The exploit includes a chosen-ciphertext attack with the use of a SSLv2 server as a Bleichenbacher oracle. The proof-of-concept attack demonstrated how both multi-GPU configurations and commercial cloud computing could perform part of the codebreaking calculations, at a cost of around $18,000 for the GPU setup and $400 for the cloud. A successful attack will provide the session key for a captured TLS handshake.

The investigators, who described the attack above as the general DROWN attack also found a specific weakness in the OpenSSL implementation of SSLv2 that allowed what they called a special DROWN attack. This vastly reduced the effort required to break the encryption, making real-time man-in-the-middle attacks possible that required only modest computing resources.

The original reporters of the bug were the security researchers Nimrod Aviram and Sebastian Schinzel.[9]

Mitigation

To protect against DROWN, server operators need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections. This includes web servers, SMTP servers, IMAP and POP servers, and any other software that supports SSL/TLS.[10]

The OpenSSL group has released a security advisory, and a set of patches intended to mitigate the vulnerability by removing support for obsolete protocols and ciphers.[11] However, if the server's certificate is used on other servers that support SSLv2, it is still vulnerable, and so are the patched servers.

Numerous sources have recommended that the vulnerability be patched as soon as possible by site operators.

References

  1. ^ Leyden, John (1 March 2016). "One-third of all HTTPS websites open to DROWN attack". The Register. Retrieved 2016-03-02.
  2. ^ Goodin, Dan (1 March 2016). "More than 11 million HTTPS websites imperiled by new decryption attack". Ars Technica. Retrieved 2016-03-02.
  3. ^ Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar, and Yuval Shavitt. DROWN: Breaking TLS using SSLv2, 2016
  4. ^ Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar, and Yuval Shavitt. DROWN: Breaking TLS using SSLv2, 2016
  5. ^ "National Cyber Awareness System Vulnerability Summary for CVE-2016-0800". web.nvd.nist.gov. Retrieved 2016-03-02.
  6. ^ "DROWN Attack". drownattack.com. Retrieved 2016-03-24.
  7. ^ "New TLS decryption attack affects one in three servers due to legacy SSLv2 support". PCWorld. Retrieved 2016-03-02.
  8. ^ Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar, and Yuval Shavitt. DROWN: Breaking TLS using SSLv2, 2016
  9. ^ "DROWN - Cross-protocol attack on TLS using SSLv2 - CVE-2016-0800 - Red Hat Customer Portal". access.redhat.com. Retrieved 2016-03-02.
  10. ^ "DROWN Attack". 1 March 2016.
  11. ^ "Cross-protocol attack on TLS using SSLv2 (DROWN) (CVE-2016-0800)". OpenSSL. 1 March 2016.


Stub icon

This cryptography-related article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=DROWN_attack&oldid=718884649"