The DROWN Attack
drownattack.com
The DROWN Attack
1–10 of 206 posts
Re: The DROWN Attack
#2From the FAQ:
"In technical terms, DROWN is a new form of cross-protocol Bleichenbacher padding oracle attack. It allows an attacker to decrypt intercepted TLS connections by making specially crafted connections to an SSLv2 server that uses the same private key."
Re: The DROWN Attack
#3These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
Re: The DROWN Attack
#4Is this new? Since I would say it's already widely known as a ssl Downgrade attack.
Re: The DROWN Attack
#5Basically, it looks like this affects servers that still support SSLv2. From the mitigation notes:
> To protect against DROWN, server operators need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections.
Also, I like this snippet:
> Disabling SSLv2 can be complicated and depends on the specific server software.
Re: The DROWN Attack
#6These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
It gets worse, some people produce a whole video around it: https://www.youtube.com/watch?v=3NL2lEomB_Y
Re: The DROWN Attack
#7These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
It gets worse, some people produce a whole video around it: https://www.youtube.com/watch?v=3NL2lEomB_Y
I guess we just rebrand some minor edge case of a well-known attack, give it a stupid name and use it to promote our security consultancy, is that it?
EDIT: Sorry, for consultancy read "peer-reviewed paper".
Re: The DROWN Attack
#8These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
It gets worse, some people produce a whole video around it: https://www.youtube.com/watch?v=3NL2lEomB_Y
That video is fun to watch though and does a pretty good job of explaining how that attack works.
Re: The DROWN Attack
#9These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
I'd be interested to know why this is the case. It's a hunch, but I reckon that this sort of 'branding' makes a serious problem more obvious and memorable. I mean, I remember 'Heartbleed' and 'GHOST', but I don't really remember the details of say CVE-2014-2523.
Re: The DROWN Attack
#10These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
I'd be interested to know why this is the case. It's a hunch, but I reckon that this sort of 'branding' makes a serious problem more obvious and memorable. I mean, I remember 'Heartbleed' and 'GHOST', but I don't really remember the details of say CVE-2014-2523.
I guess it depends whether Heartbleed and GHOST are actually more serious than the ones without names.