The cybersecurity experts from universities in Israel,
Germany and the US as well as a member of Google's security team found that more
than 81,000 of top one million popular websites are vulnerable.
The researchers said many popular sites - including ones
belonging to Samsung, Yahoo and a leading Indian bank - appeared to be
vulnerable.
The DROWN attack works against TLS-protected communications
that rely on the RSA cryptosystem when the key is exposed even indirectly
through short for secure sockets layer version 2 (SSLv2).
The vulnerability allows everyone on the internet to browse
the web, use e-mail, shop online and send instant messages without third-parties
being able to read the communication. It
allows attackers to break the encryption and read or steal sensitive
communications, including passwords, credit card numbers, trade secrets, or
financial data. Under some common scenarios, an attacker can also impersonate a
secure website and intercept or change the content the user sees.
While many security experts believed the removal of SSLv2
support from browser and e-mail clients prevented abuse of the legacy protocol,
some misconfigured TLS implementations still tacitly support the legacy
protocol when an end-user computer specifically requests its use.
Websites, mail servers, and other TLS-dependent services are
at risk for this attack, and many popular sites are affected.
In practice, older email servers would be more likely to
have this problem than the newer computers typically used to power websites.
In addition, because many of the servers vulnerable to Drown
were also affected by a separate bug, a successful attack could be carried out
using a home computer.
Though a fix has been issued but it will take time for many
of the website administrators to protect their systems.
The researchers have released a tool that identifies
websites that appear to be vulnerable.
The SSLv2 protocol was weakened because, at the time of its
creation, the US government wanted to try to restrict the availability of tough
encryption standards to other countries.
It has since eased its export limits, but the effects live
on.