DROWN HTTPS Vulnerability Threatens 11 Million Open SSL Web Sites

[IDemo]

Source: CIO Today

A newly discovered vulnerability could threaten the security Relevant Products/Services of millions of Web sites previously thought to be relatively safe from attack Relevant Products/Services. The exploit, called a DROWN attack, affects sites protected by some of the most common security measures such as HTTPS, SSL, and TLS.

Using DROWN, a hacker can break encryptions to read users’ communications and steal usernames and passwords, credit card numbers, trade secrets and financial data Relevant Products/Services. Around 33 percent of all HTTPS servers are vulnerable to DROWN, a group that includes Web sites, mail servers, and other TLS-dependent services, according to the research team that discovered the exploit.

The exploit was discovered by a group of researchers from a number of academic institutions, tech companies, and open source projects, including Tel Aviv University, the University of Pennsylvania, the Hashcat project, the University of Michigan, Google, and the OpenSSL project.

What appears to be particularly frightening is the lack of options for end users to protect themselves from the threat. “Operators of vulnerable servers need to take action,” the research team wrote. “There is nothing practical that browsers or end-users can do on their own to protect against this attack.”

Read more: http://www.cio-today.com/article/index.php?story_id=0020002HFCKK

[2naSalit]

1. great.

[RiverNoord]

2. And it's time to patch the firewall again...

[bemildred]

3. Priceless.

The researchers said that DROWN is the result of the U.S. government’s encryption restrictions that were designed to weaken Internet security in the 1990s.

“Although these restrictions, evidently designed to make it easier for NSA (National Security Agency) to decrypt the communication of people abroad, were relaxed nearly 20 years ago, the weakened cryptography remains in the protocol specifications and continues to be supported by many servers today, adding complexity -- and the potential for catastrophic failure -- to some of the Internet’s most important security features,” the researchers said.

The government deliberately weakened three kinds of cryptographic primitives: RSA encryption, Diffie-Hellman key exchange, and symmetric ciphers, according to the research team. The team said that decades later all three kinds of deliberately weakened cryptography have put the security of the Internet at risk.

[LiberalArkie]

4. Good ol NSA

The researchers said that DROWN is the result of the U.S. government’s encryption restrictions that were designed to weaken Internet security in the 1990s.

“Although these restrictions, evidently designed to make it easier for NSA (National Security Agency) to decrypt the communication of people abroad, were relaxed nearly 20 years ago, the weakened cryptography remains in the protocol specifications and continues to be supported by many servers today, adding complexity -- and the potential for catastrophic failure -- to some of the Internet’s most important security features,” the researchers said.

The government deliberately weakened three kinds of cryptographic primitives: RSA encryption, Diffie-Hellman key exchange, and symmetric ciphers, according to the research team. The team said that decades later all three kinds of deliberately weakened cryptography have put the security of the Internet at risk.

[Cavallo]

8. +10000

[Tab]

5. I've asked a friend for his opinion

(he's a lead of one of the task forces that sets standards for the Internet)

I'm curious to see what his opinion is. Be happy to post a synopsis of what he said.

[C Moon]

6. This was in the L.A. Times print version this morning regarding Net Neutrality...

Just one more thing the GOP is still trying to get their grubby hands on...

Strange that the article is nowhere to be found on the L.A. Times online version. :/
Maybe if I log in it's there somewhere.

http://www.pressreader.com/usa/los-angeles-times/20160302/281917362164461

Senator blasts Obama role in Internet ruling
WASH­ING­TON — Pres­i­dent Obama “un­duly inf lu­enced” fed­eral reg­u­la­tors to adopt tough net neu­tral­ity reg­u­la­tions for on­line traf­fic last year, ac­cord­ing to an in­ves­ti­ga­tion by a Repub­li­can sen­a­tor.

Tom Wheeler, chair­man of the Fed­eral Com­mu­ni­ca­tions Com­mis­sion, and his staff were fin­ish­ing work on a less heavy- handed ap­proach in Novem­ber 2014 when Obama pub­licly called for the agency to take a more ag­gres­sive and con­tro­ver­sial di­rec­tion, said a re­port re­leased Tues­day from Sen. Ron John­son ( R- Wis.), chair­man of the Se­nate Home­land Se­cu­rity and Govern­ment Af­fairs Com­mit­tee.

Obama urged the in­de­pen­dent FCC to put broad­band providers in the same le­gal cat­e­gory as more highly reg­u­lated con­ven­tional tele­phone com­pa­nies.

[LiberalArkie]

7. I guess I should point out that Bill Clinton wanted a backdoor in all digital services.

He wanted a chip installed called "Clipper Chip" that would enable to gov to have free and anytime access to digital information. This did not pass, but putting mandatory back doors in the encryption software did. Until PGP came along.

[Nihil]

10. I'd forgotten that Clinton was behind the "Clipper" debacle ...

I'd have guessed at Bush I or even Reagan as it had slipped into my
personal memory hole ...

[PeoViejo]

9. A 'One-time Pad is the only secure encryption

There is no key.

[joshcryer]

11. First HEARTBLEED and now this?

The NSA is not doing its fucking job.