How safe is your site from a ‘Drown hack’ attack?

By Lulu Chang March 2, 2016

A pair of hands on a laptop keyboard with two displays.

With digital security on the forefront of global consciousness, a new report suggesting that “thousands of popular sites” might be vulnerable to one type of cyberattack has raised alarm bells.

According to experts, the so-called Drown attack is a “serious vulnerability that affects HTTPS and other services that rely on SSL and TLS, some of the essential cryptographic protocols for Internet security.” With this sort of attack, hackers would be able to “break the encryption and read or steal sensitive communications, including passwords, credit card numbers, trade secrets, or financial data.” Most terrifying of all, it is estimated that 33 percent of HTTPS servers are vulnerable.

Recommended Videos

Luckily, there is a fix available, and it’s already been disseminated to help site administrators add an extra layer of security to their online domains. Still, it will take time to fully implement, and in the meantime, the hackers may still have access to a significant chunk of the Internet.

“What is shocking about this is that they [the hackers] have found a way to use a very old fault that we have known about since 1998,” Professor Alan Woodward of the University of Surrey told the BBC. “And all this was perfectly avoidable. It is a result of us having used deliberately weakened encryption, which people broke years ago, and it is now coming back to haunt us.”

So what can you now do? The researchers studying the issue note that, “To protect against Drown, server operators need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections. This includes web servers, SMTP servers, IMAP and POP servers, and any other software that supports SSL/TLS.” Drownattack.com also provides a form to “check whether your server appears to be exposed to the attack.”

Ultimately, a complete solution requires some expertise. “Operators of vulnerable servers need to take action,” the researchers wrote. “There is nothing practical that browsers or end-users can do on their own to protect against this attack.”

Topics

Former Digital Trends Contributor

Fascinated by the effects of technology on human interaction, Lulu believes that if her parents can use your new app…

Computing

Destructive hacking group REvil could be back from the dead

Person typing on a computer keyboard.

There was a period in 2021 when the computing world was gripped by fear of a dizzyingly effective hacking group fittingly named REvil -- until its website was seized by the FBI and its members arrested by Russia’s security services, that is. Yet like a malevolent curse that just can’t be dispelled, it now seems the group’s websites are back online. Has the group returned to spread discord and wreak havoc once again?

In case you missed them the first time around, REvil came to global attention by hacking into various high-profile targets, pilfering secret documents, then threatening their release unless a ransom was paid. In a notable case, the group stole and published files from Apple supplier Quanta Computer, including some that spilled the beans on unreleased product designs.

Computing

Not even your PC’s power supply is safe from hackers

Eaton 5S1500LCD UPS Battery Backup.

Hackers have managed to find a way to successfully gain access to uninterruptable power supply (UPS) computer systems, according to a report from The Cybersecurity and Infrastructure Security Agency (CISA).

As reported by Bleeping Computer and Tom’s Hardware, both the Department of Energy and CISA issued a warning to organizations based in the U.S. that malicious threat actors have started to focus on infiltrating UPS devices, which are used by data centers, server rooms, and hospitals.

Space

Curiosity investigates how to keep Mars explorers safe from radiation

NASA’s Curiosity Mars rover used its Mars Hand Lens Imager, or MAHLI, to take this selfie at the “Quela” drilling location in the “Murray Buttes” area on lower Mount Sharp between Sept. 17 and 18, 2016.

One of the biggest dangers to humans when planning a mission to Mars is something invisible: Radiation. Without the Earth's magnetosphere to protect them, astronauts would be bombarded with radiation while visiting Mars. And although living on the red planet for a few months probably wouldn't be immediately fatal, it would increase lifetime risks for illnesses like cancer considerably.

There are plans like using shielding or medication to protect future astronauts visiting Mars, but there's still a huge amount we don't know about the radiation risks there. To address these unknowns, NASA's Curiosity rover is armed with a radiation detector and is performing experiments to see how we could protect astronauts against dangerous radiation particles.