{"id":195203,"date":"2016-03-02T14:08:50","date_gmt":"2016-03-02T14:08:50","guid":{"rendered":"http:\/\/4cd.e16.myftpupload.com\/?p=195203"},"modified":"2016-03-02T14:08:50","modified_gmt":"2016-03-02T14:08:50","slug":"195203","status":"publish","type":"post","link":"https:\/\/citifmonline.com\/?p=195203","title":{"rendered":"‘Thousands of popular sites’ at risk of Drown hack attacks"},"content":{"rendered":"

Websites have been warned they could be exposed to eavesdroppers, after researchers discovered a new way to disable their encryption protections.<\/p>\n

The experts said about a third of all computer servers using the HTTPS protocol – often represented by a padlock in web browsers – were vulnerable to so-called Drown attacks.<\/p>\n

They warn that passwords, credit card numbers, emails and sensitive documents could all be stolen as a consequence.<\/p>\n

A fix has been issued.<\/p>\n

But it will take some time for many of the website administrators to protect their systems.<\/p>\n

The researchers have released a tool that identifies websites that appear to be vulnerable.<\/p>\n

They said they had not released the code used to prove their theory because “there are still too many servers vulnerable to the attack”.<\/p>\n

As yet, there is no evidence hackers have worked out how to replicate their technique.<\/p>\n

An independent expert said he had no doubt the problem was real.<\/p>\n

“What is shocking about this is that they have found a way to use a very old fault that we have known about since 1998,” said Prof Alan Woodward, from the University of Surrey.<\/p>\n

“And all this was perfectly avoidable.<\/p>\n

“It is a result of us having used deliberately weakened encryption, which people broke years ago, and it is now coming back to haunt us.”<\/p>\n

\"Drown<\/span><\/figure>\n
<\/figure>\n

Call to action\u00a0<\/strong><\/p>\n

The researchers, cybersecurity experts from universities in Israel, Germany and the US as well as a member of Google’s security team, found a computer server could be vulnerable to attack just by supporting 1990s-era encryption protocol SSLv2 (Secure Sockets Layer version 2), even if in day-to-day use it employed more modern encryption standards to scramble communications.<\/p>\n

In practice, older email servers would be more likely to have this problem than the newer computers typically used to power websites.<\/p>\n

But many organisations reuse encryption certificates and keys between the two sets of servers.<\/p>\n

The researchers dubbed the flaw Drown – an acronym for decrypting the Rivest-Shamir-Adleman (RSA) algorithm with obsolete and weakened encryption.<\/p>\n

“Operators of vulnerable servers need to take action,” they wrote.<\/p>\n

“There is nothing practical that browsers or end-users can do on their own to protect against this attack.”<\/p>\n

\"Computer<\/span><\/figure>\n

Export restrictions\u00a0<\/strong><\/p>\n

The SSLv2 protocol was deliberately weakened because, at the time of its creation, the US government wanted to try to restrict the availability of tough encryption standards to other countries.<\/p>\n

It has since eased its export limits, but the effects live on.<\/p>\n

“The problem is that while clients – such as [web] browsers – have done away with SSLv2, many servers still support the protocol,” blogged Prof Matthew Green, from Johns Hopkins University.<\/p>\n

“In most cases this is the result of careless server configuration.<\/p>\n

“In others, the blame lies with crummy and obsolete embedded devices that haven’t seen a software update in years – and probably never will. ”<\/p>\n

Quick attack<\/strong><\/p>\n

To mount a successful attack on a website would still require a considerable amount of computational force.<\/p>\n

But, the researchers said, under normal circumstance, hackers could rent the required capacity from Amazon’s cloud compute division for as little as $440 (\u00a3314).<\/p>\n

In addition, because many of the servers vulnerable to Drown were also affected by a separate bug, a successful attack could be carried out using a home computer.<\/p>\n

“This form of the attack is fast enough to allow an online man-in-the-middle style of attack, where the attacker can impersonate a vulnerable server to the victim,” the researchers wrote.<\/p>\n

“We were able to execute this form of the attack in under a minute on a single PC.”<\/p>\n

The researchers said many popular sites – including ones belonging to Samsung, Yahoo and a leading Indian bank – appeared to be vulnerable.<\/p>\n

Prof Woodward said the team’s test had also indicated a problem with bbc.co.uk.<\/p>\n

“The weakness is actually in the old Pop3 server,” he said.<\/p>\n

“Few people still use Pop3, but it means that things like your password reset server could theoretically be eavesdropped upon.”<\/p>\n

–<\/p>\n

Source: BBC<\/p>\n","protected":false},"excerpt":{"rendered":"

Websites have been warned they could be exposed to eavesdroppers, after researchers discovered a new way to disable their encryption protections. The experts said about a third of all computer servers using the HTTPS protocol – often represented by a padlock in web browsers – were vulnerable to so-called Drown attacks. They warn that passwords, […]<\/p>\n","protected":false},"author":14,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jnews-multi-image_gallery":[],"jnews_single_post":[],"jnews_primary_category":[],"jnews_social_meta":[],"jnews_override_counter":[],"footnotes":""},"categories":[106],"tags":[],"class_list":["post-195203","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/posts\/195203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=195203"}],"version-history":[{"count":0,"href":"https:\/\/citifmonline.com\/index.php?rest_route=\/wp\/v2\/posts\/195203\/revisions"}],"wp:attachment":[{"href":"https:\/\/citifmonline.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=195203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=195203"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/citifmonline.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=195203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}