The DROWN Attack (33c3)
Channel: media.ccc.de
Date: 27/12/2016

https://media.ccc.de/v/33c3-7821-the_drown_attack

Breaking TLS using SSLv2

We present DROWN, a novel cross-protocol attack on TLS that uses a server supporting SSLv2 as an oracle to decrypt modern TLS connections. Using Internet-wide scans, we find that 33% of all HTTPS servers are vulnerable to this protocol-level attack.



['Sebastian Schinzel']