Tag: drown | Qualys Blog

DROWN Grading Update

Posted by Ivan Ristic in SSL Labs on March 4, 2016

We are releasing an update to the grading criteria, version 2009l, to respond to the discovery of the DROWN attack. If a server is found to be vulnerable to DROWN it will be given an F, even though it might not support SSL v2 itself. (The nature of the DROWN vulnerability is such that servers that support SSL v2 can affect other servers, irrespective of supported protocol versions). You’ll find more information about our DROWN test here. Additionally, servers that support SSL v2 but don’t have any cipher suites configured are treated as if they had SSL v2 fully enabled.

This update also contains two fixes to our grading code, which we don’t consider to be changes to our grading criteria:

Servers that have invalid HPKP information are not awarded A+.
Servers that have an RSA key with exponent 1 are given an F.

SSL Labs DROWN Test Implementation Details

Posted by Ivan Ristic in Security Labs, SSL Labs on March 4, 2016

Two days ago the DROWN vulnerability came to light, showing new ways to attack TLS. SSL Labs deployed tests for DROWN in the staging environment yesterday, and we’ll be pushing it to production shortly. Because DROWN is a tricky problem, the aim of this blog post is to provide an explanation of what we test for and how exactly.

DROWN Abuses SSL v2 to Attack TLS

Posted by Ivan Ristic in Security Labs, SSL Labs on March 1, 2016

A fascinating new research called DROWN has uncovered a previously-unknown vulnerability in SSL v2, the first ever version of SSL that was released in 1995 and declared dead less than a year later. Even though this old version of SSL is not used much these days, it continues to be supported by many servers. The especially bad aspect of this attack is that it can be used to exploit TLS, even in cases when client devices don’t support SSL v2, and sometimes even in cases when the servers don’t support SSL v2 (but use the same RSA key as some other server that does). The researchers estimate that up to 22% of servers could be impacted by this problem.