Better explanation: http://blog.cryptographyengineering.com/2016/03/attack-of-we...
The DROWN Attack
21–30 of 206 posts
Re: The DROWN Attack
#22If you want to check your servers for various other attacks with a shell script:
Also, I'm not seeing any guides on fixes for Dovecot yet. If you built from source or the defaults aren't working, you can use the following:
ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL
ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!RC4:+HIGH:+MEDIUM
Also, you may need to update your Exim configs as well:
tls_require_ciphers = AES128+EECDH:AES128+EDH
openssl_options = +no_sslv2 +no_sslv3
Re: The DROWN Attack
#23These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
Well how long before the novelty names run out of meaning ? For starters there are probably more issues out there then there are catchy American English anachronisms. I vote for using the names of Mezzo-American gods . Like Hachäk'yum or Xbalanque!
Re: The DROWN Attack
#24[deleted]
Re: The DROWN Attack
#25According to the info page, SSLv2 can only be disabled on OpenSSL by having the right (newer) version of OpenSSL installed.
I just checked Debian versions.
Wheezy (oldstable): Much to old OpenSSL versions, according to the info site
Jessy (stable): Still to old OpenSSL version.
Stretch (testing): Still to old OpenSSL version.
Sid (unstable): The same version of OpenSSL as Stretch -- Still to old.
What to do?
Re: The DROWN Attack
#26These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
Marketing helps market the awareness of these problems, even non-tech folk have heard of Heartbleed. More awareness probably means software is likely to be updated.
Re: The DROWN Attack
#27Oh come on, it targets SSLv2. You better have a _damn_ good reason for still having SSLv2 enabled on your systems. If you didn't, you had this one coming.
One reason: Using a distribution that uses old OpenSSL versions (see my own post).
Re: The DROWN Attack
#28These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
Would be wonderful, you could also develop a fix and call it COCKBLOCK Edit: dear Ben, you let us down :(
Careful! Adria Richards will take your photo and tweet it, then blow her USB whistle!
(BTW: Did Adria Richards realize that "Python" as in "Monty Python" is one big Penis Joke?)
Re: The DROWN Attack
#29These marketed attacks with special logos drive me up the wall. If I ever discover one I'll give it a rude name and force everyone to look at a silly picture to go with it.
But Heartbleed was the first one, and it's marketing made it get everywhere. Regular newspapers, etc.
Instead of hating people marketing vulnerbilities, tackle why people-in-power don't care about vuln when communicated the old way.
Re: The DROWN Attack
#30From a pool of 11 million scans of HTTPS sites, I could only find ~265k targets with SSLv2 enabled [1]. That's 2.4%, not 25%. A breakdown of the type of target that have SSLv2 enabled would be useful to understand how they reached that number. It's possible that they scanned much much more than HTTPS on port 443, and found a lot of embedded devices with poor SSL configurations. At any rate, you should verify the conf…
[deleted]