How safe is your site from a ‘Drown hack’ attack?

According to experts, the so-called Drown attack is a “serious vulnerability that affects HTTPS and other services that rely on SSL and TLS, some of the essential cryptographic protocols for Internet security.” With this sort of attack, hackers would be able to “break the encryption and read or steal sensitive communications, including passwords, credit card numbers, trade secrets, or financial data.” Most terrifying of all, it is estimated that 33 percent of HTTPS servers are vulnerable.

Luckily, there is a fix available, and it’s already been disseminated to help site administrators add an extra layer of security to their online domains. Still, it will take time to fully implement, and in the meantime, the hackers may still have access to a significant chunk of the Internet.

“What is shocking about this is that they [the hackers] have found a way to use a very old fault that we have known about since 1998,” Professor Alan Woodward of the University of Surrey told the BBC. “And all this was perfectly avoidable. It is a result of us having used deliberately weakened encryption, which people broke years ago, and it is now coming back to haunt us.”

So what can you now do? The researchers studying the issue note that, “To protect against Drown, server operators need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections. This includes web servers, SMTP servers, IMAP and POP servers, and any other software that supports SSL/TLS.” Drownattack.com also provides a form to “check whether your server appears to be exposed to the attack.”

Ultimately, a complete solution requires some expertise. “Operators of vulnerable servers need to take action,” the researchers wrote. “There is nothing practical that browsers or end-users can do on their own to protect against this attack.”