HTTPS DROWN flaw: Security bods' hearts sink as tatty protocols wash away web crypto

The discovery of a HTTPS encryption vulnerability, dubbed DROWN, again proves that supporting tired old protocols weakens modern crypto systems. DROWN (aka Decrypting RSA with Obsolete and Weakened eNcryption) is a serious design flaw that affects HTTPS websites and other network services that rely on SSL and TLS – which are …

[Anonymous Coward]

Apache httpd

I get A+ from ssl labs:

SSLProtocol all -SSLv2 -SSLv3

SSLHonorCipherOrder on

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"

[John Sanders]

Re: Apache httpd

I haven't seen an Apache server in the wild that has SSLv2 enabled for years.

As "linicks" suggest: "SSLProtocol all -SSLv2 -SSLv3" and be done with it.

[Anonymous Coward]

Re: Apache httpd

Use "SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1"

[Anonymous Coward]

Re: Apache httpd

You missed the point. This is not just an "HTTPS" issue. It's a SSL/TLS issue. You can disable SSLv2 on Apache, and if you have a mail server which still supports SSLv2 and shares the keys with Apache, it will make TLS connections to Apache vulnerable. And if you have say an IMAP server using TLS, and an SMTP server still offerint SSLv2, the IMAP connection is vulnerable.

It's important to understand the SSL/TLS suite is a generic security protocol in no way tied to HTTP. It can be used, and it is used, in many other protocols, including custom ones.

While web servers may be the more prominent users of SSL/TLS, they are not the only users. So if you just think about SSL/TLS as the S in HTTPS only, you will miss to patch/reconfigure a lot of other servers which are actually using it as well, leaving them vulnerable.

[TheVogon]

Re: Apache httpd

My personal Windows Server based SSL gateway gets A+ when tested at www.htbridge.com

Powershell script here to fix outdated configs:

https://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12

[Dan 55]

Is SSLv2 still supported in OpenSSL?

LibreSSL knocked SSLv3 on the head last summer.

[wolfetone]

Re: Is SSLv2 still supported in OpenSSL?

It is yes. And OpenSSL has it's bugs still. One being you can't turn off specific TLS versions. I know you won't want to, but during debugging it proved to be a pain in the arse.

[Justin Pasher]

@wolfetone Re: Is SSLv2 still supported in OpenSSL?

Actually it depends. The Debian binaries removed the SSLv2 protocol from OpenSSL back in 1.0.0c-2 (i.e. post-squeeze, pre-wheezy).

https://www.debian.org/security/2016/dsa-3500

[wolfetone]

Re: @wolfetone Is SSLv2 still supported in OpenSSL?

@Justin Pasher "Actually it depends. The Debian binaries removed the SSLv2 protocol from OpenSSL back in 1.0.0c-2 (i.e. post-squeeze, pre-wheezy)."

I had to deal with some idiots who make middleware for Magento and another system this company uses, and they wanted me to turn off TLS v.1.1 and I couldn't. I went in the Apache conf file, did what I had to do, and it was still showing up.

According to a bug report for OpenSSL for Debian 7 (don't have the time to find it I'm afraid) it said there are instances when using Apache and OpenSSL where you can't do that. HOPEFULLY they will fix this in the future.

[Roland6]

Re: Is SSLv2 still supported in OpenSSL?

One being you can't turn off specific TLS versions. I know you won't want to.

Famous last words?

I think what we've learnt todate with SSL, the ability enable and disable specific schemes and versions is going to be important in the future...

[DainB]

In other news

If you use telnet to access your server all your traffic is in clear text.

[Destroy All Monsters]

Re: In other news

Yes?

[Anonymous Coward]

Re: In other news

For people under the age of 40, Telnet is a user command and an underlying TCP/IP protocol for accessing remote computers. Through Telnet, an administrator or another user can access someone else's computer remotely.

[Lysenko]

Re: In other news

I think his point is that having telnet still knocking around long after it was supplanted by SSH for most (all?) purposes is analogous.

[dan1980]

Re: In other news

But is it analogous?

Telnet is cleartext; SSH is encrypted. How is that comparable? In this situation, both protocols were supposed to be secure (Government hobbling notwithstanding).

Telnet still being available is like HTTP still being available.

[Lysenko]

How is that comparable?

Telnet was supposed to be secure too because it was designed with the assumption that the network itself would be secured and the great unwashed wouldn't be given a key to a room with a terminal in it. That model still holds in certain use cases. I continue to use telnet to commission embedded systems that physically have no TCP/IP network connectivity in production use and therefore cannot be compromised in that way.

[Sandtitz]

Re: In other news @Lysenko

I still use telnet every now and then to troubleshooting connection problems - i.e. can I connect to a specific port or not. Fast and easy.

[The First Dave]

Re: In other news @Lysenko

And _I_ used telnet just yesterday to test an SMTP connection...

[steamrunner]

Re: In other news @Lysenko

Ah, the joys of command-line SMTP... :-)

[Alistair]

Re: In other news @Lysenko

@ sandtitz

I prefer netcat and variants thereof, more appropriate for connection diagnostics.

Honestly, I remove telnet -- both server and client where I find it. It keeps people complaining (OMG!! INSTALL ME TELNET NAO!!) to which I reply with a clue by four.

[Steve Knox]

"...supporting SSLv2 server-side was not generally considered a security problem because no client-side software was using it."

Supporting anything server-side which is not used by client-side software is a security problem. Why would you enable something which isn't needed?

[Destroy All Monsters]

Ariane 5 went down due to "unnecessary code"...

[Graham Marsden]

"Decrypting RSA with Obsolete and Weakened eNcryption"

Well they couldn't call it DROW because they'd be sued by Wizards of the Coast...

[CheesyTheClown]

Kyle Lady says...

Did we need a "Security Expert" to tell us that "We need to implement security"?

Ok... so step 1... if you want to secure your network, learn how to secure your network. Some numb nuts from a security firm can charge you $10,000 a day to run free tools off a Kali Linux download and print a report for you and tell you 10,000 places you need to fix... and btw, I can sell you this tool.

Or, you can do your jobs, run Kali yourself fix the obvious and mitigate the problem children like appliances which have HTTP but not HTTPS since they run on 1KB of RAM (think about your PDUs).

Remember security experts don't know how your network works and they don't really care. They just run scripts, print reports and sell stuff. You can skip them and move on.

[Destroy All Monsters]

Re: Kyle Lady says...

You must be 16 years old for not having realized yet that specializations exist for a reason.

[John G Imrie]

Re: Kyle Lady says...

<cynicism>

If I run the tests and give the company a clean bill of health and we get hacked it's my job on the line. If I call in a security bod and he gives us a clean bill of health and we get hacked it's not my problem.

</cynicism>

[Anonymous Coward]

Re: Kyle Lady says...

"If I call in a security bod and he gives us a clean bill of health and we get hacked it's not my problem"

ehhh, you're still the one who called him in.... so fingers could still get pointed.

[Zog_but_not_the_first]

Security bods' hearts sink...

Shouldn't that be "Security bods' hearts bleed"?

[Pen-y-gors]

Slight correction

"DROWN basically allows a miscreantGovernment agency to snoop on and decrypt a victim's encrypted web connections, allowing crooksGovernment agents to swipe passwords and so on.

"DROWN allows attackersGovernment agencies to break the encryption and read or steal sensitive communications, including passwords, credit card numbers, trade secrets, or financial data," said the research team.

FTFY

GCHQ/NSA will not be happy with this disclosure.

[Allonymous Coward]

The important thing is

They came up with a catchy name (plus associated domain, plus associated logo) for the exploit. That's apparently important these days.

[Anonymous Coward]

SSL died a long time ago

Adding something like this to the SSL config in Apache sorts this out :

SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:!SSLv3:RC4+RSA:+HIGH:+MEDIUM:+LOW

[I. Aproveofitspendingonspecificprojects]

Someone help me

Didn't a bunch of ex-scumware ex-adware makers (phorm-like adcounters and the like) all sit down in company with US security experts in the good old days of Widows 98 and the endless HijackThis forums and decide how best to run security with Microsoftware. Linux bods specifically uninvited?