The DROWN Attack • Hacker News Board

Re: The DROWN Attack

#11

Post by themartorana » Tue, Mar 01, 2016, 1:29 PM UTC

bencollier49 wrote: post #3

These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.

Seems a bit harsh and unnecessary. This is so much clearer than a security bulletin on a mailing list I'll never see. I'm pretty sure our sites are safe but now I'll remember to check.

Rebels without a cause...

Re: The DROWN Attack

#12

Post by camillomiller » Tue, Mar 01, 2016, 1:29 PM UTC

bencollier49 wrote: post #3

These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.

Would be wonderful, you could also develop a fix and call it COCKBLOCK

Edit: dear Ben, you let us down :(

Re: The DROWN Attack

#13

Post by jamescun » Tue, Mar 01, 2016, 1:35 PM UTC

bencollier49 wrote: post #3

These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.

I'm on the fence over the "marketing". On one hand it is easier to communicate terms like DROWN, GHOST and Heartbleed than say CVE-2016-0800; meaning knowledge of the vulnerability gets spreads quicker and sites are patched more readily. Alternatively it could be a distraction from good security management practices, where only the "marketed" vulnerabilities get patched instead of general tracking the security of critical pieces of your infrastructure.

Re: The DROWN Attack

#14

Post by wingerlang » Tue, Mar 01, 2016, 1:40 PM UTC

taf2 wrote: post #8

danielbln wrote: post #6

Earlier quoted context omitted.

It gets worse, some people produce a whole video around it: https://www.youtube.com/watch?v=3NL2lEomB_Y

That video is fun to watch though and does a pretty good job of explaining how that attack works.

I agree, but it also felt like one of those TV Shop videos where you just know that you're being sold to.

Re: The DROWN Attack

#15

Post by justinjlynn » Tue, Mar 01, 2016, 1:41 PM UTC

camillomiller wrote: post #12

bencollier49 wrote: post #3

These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.

Would be wonderful, you could also develop a fix and call it COCKBLOCK Edit: dear Ben, you let us down :(

Then develop a workaround for the fix and call it COCKKNOCKER.

Edit: Well, OP edited their comment and now mine makes no sense... time to take a break.

Re: The DROWN Attack

#16

Post by CJefferson » Tue, Mar 01, 2016, 1:41 PM UTC

neoeldex wrote: post #4

Is this new? Since I would say it's already widely known as a ssl Downgrade attack. https://en.wikipedia.org/wiki/Downgrade_attack

Nope, this is different.

Your machine can not support SSLv2 at all (so you couldn't be downgraded), but the existence of SSLv2 on the server (or a different server running SSLv2, say an e-mail server) allows the attack.

Re: The DROWN Attack

#17

Post by jvehent » Tue, Mar 01, 2016, 1:43 PM UTC

From a pool of 11 million scans of HTTPS sites, I could only find ~265k targets with SSLv2 enabled [1]. That's 2.4%, not 25%.

A breakdown of the type of target that have SSLv2 enabled would be useful to understand how they reached that number. It's possible that they scanned much much more than HTTPS on port 443, and found a lot of embedded devices with poor SSL configurations.

At any rate, you should verify the configuration of your websites. There are many tools to do that, and we publish configuration sample to make it easy: https://mozilla.github.io/server-side-tls/ssl-config-generat...

[1] https://twitter.com/jvehent/status/704657734810148864

[edit] the page https://drownattack.com/top-sites shows that sites like yahoo.com are vulnerable, but there are no details as to why it is listed vulnerable. yahoo.com does not allows connections with SSLv2, but some of its subdomains do, so maybe the top-level domain is listed because some of its subdomains are vulnerable?

[edit 2] according to one of the researcher, the scanner "check if pubkey (not cert) runs on SSLv2. Then mark all others with that pubkey vuln" (src: https://twitter.com/seecurity/status/704665265712308224)

Re: The DROWN Attack

#18

Post by Mojah » Tue, Mar 01, 2016, 1:43 PM UTC

Oh come on, it targets SSLv2. You better have a _damn_ good reason for still having SSLv2 enabled on your systems.

If you didn't, you had this one coming.

Re: The DROWN Attack

#19

Post by skywhopper » Tue, Mar 01, 2016, 1:48 PM UTC

So, disable SSLv2. That is not new information. I like how the FAQ insists you are still at risk if you've disabled SSLv2 because you still might be using it somewhere else!!! In other words, if you've not disabled SSLv2 everywhere, then there are still places where SSLv2 is enabled. Thank you.

Re: The DROWN Attack

#20

Post by bencollier49 » Tue, Mar 01, 2016, 1:51 PM UTC

justinjlynn wrote: post #15

camillomiller wrote: post #12

Earlier quoted context omitted.

Would be wonderful, you could also develop a fix and call it COCKBLOCK Edit: dear Ben, you let us down :(

Then develop a workaround for the fix and call it COCKKNOCKER. Edit: Well, OP edited their comment and now mine makes no sense... time to take a break.

Sorry! I need a more pseudonymous HN account.