March 3, 2016 By Larry Loeb 2 min read

OpenSSL is a cryptographic library used in many server products. But organizations should be advised that the library has a vulnerability, recently announced by the maintainers of the OpenSSL library, called DROWN, or Decrypting RSA with Obsolete and Weakened Encryption. It is also tracked by CVE-2016-0800. This was first reported to the library on Dec. 29, 2015, by security researchers who also published an official paper on the vulnerability.

Support Leads to Vulnerability

The vulnerability centers around the now-obsolete protocol SSLv2, a 1990s-era predecessor to TLS. Modern servers and clients almost uniformly use the TLS encryption protocol. SSLv2 was known to be insecure, but having support for it in OpenSSL was not thought to be harmful to security since it was so rarely used.

That assumption was wrong. Simply having SSLv2 support present in OpenSSL opens it up to the DROWN vulnerability. The vulnerability can enable the attacker to decrypt the TLS connections between up-to-date clients and servers if certain other conditions are met.

DROWN works by probing a server that supports SSLv2 and uses the same private key as TLS servers and clients. Using the same security certificate on two different servers means they will share the same private key.

OpenSSL Attacks Stem From Certificate Issues

This is a more common situation than it appears at first glance. Many companies will reuse the same certificate (and hence private key) on their Web and email servers. In this case, the email server may support SSLv2, but the Web server will not. An attacker can find the key of the email server via DROWN and then use it to decrypt the TLS connections to the Web server.

The authors of the DROWN paper found that this is not an expensive or particularly strenuous attack to perform. “A typical scenario requires the attacker to observe 1,000 TLS handshakes, then initiate 40,000 SSLv2 connections and perform 2 to the 50th power offline work to decrypt a 2048-bit RSA TLS ciphertext,” the researchers said.

They went on to note that they decrypted a TLS 1.2 handshake using 2048-bit RSA for $440 in less than eight hours.

Mitigation and Resolution

An Internet scan by the researchers showed that more than 2.3 million HTTPS servers with browser-trusted certificates are vulnerable to DROWN, SecurityWeek reported. But disabling SSLv2 support may be rather hard. It could already be embedded in products that are in use. Fortunately, Microsoft IIS (version 7 and above) and the Network Security Services (NSS) library (versions 3.13 and above) have SSLv2 support disabled by default.

A tool to see if a server is vulnerable to DROWN is available; all users have to do is type the server name or IP address into a dialog box.

OpenSSL 1.0.2g and 1.0.1s, which disable SSLv2 by default at build time, have been released. These versions also ensure that it’s impossible to configure a TLS server improperly, preventing DROWN from becoming an issue.

Client-side software such as browsers cannot take any action to mitigate this risk. Only a server can change the software needed to fix this, but it’s certainly a worthwhile effort.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today