# MA-580.032016: MyCERT Alert - SSLv2 DROWN Attack

**Date:** 02 Mar 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-580.032016  
**Advisory ID:** MA-580.032016

---

####
**1.0 Introduction**
MyCERT received information from valid sources regarding a vulnerability that exists in servers supporting OpenSSLv2. The vulnerability is known as DROWN which stands for **D**ecrypting **R**SA with **O**bsolete and **W**eakened encryption, is a serious vulnerability that affects HTTPS and other services that rely on SSL and TLS, some of the essential cryptographic protocols for Internet security.
These protocols allow everyone on the Internet to browse the web, use email, shop online, and send instant messages without third-parties being able to read the communication.
Users and administrators are encouraged to refer to the Vulnerability Note VU#583776 and the US-CERT OpenSSL Current Activity at the end of this Alert for additional information and mitigation details.
**2.0 Impact**
The impact of this vulnerability is a remote attacker may be able to break the encryption and read or steal sensitive communications, including passwords, credit card numbers, trade secrets, or financial data. Under some common scenarios, an attacker can also impersonate a secure website and intercept or change the content the user sees.
**3.0 Recommendation**
MyCERT highly recommends System Administrators to check whether their servers is affected by this vulnerability by checking at the below tool:
- MyCERT Tool 
<https://drown.honeynet.org.my/>
- Other tool to check if a server is vulnerable to DROWN attack:
<https://drownattack.com/#check>
If your version of OpenSSL is affected by this vulnerability, you may refer to the below recommendations:
> **3.1 Disable SSLv2**
> Network administrators should disable SSLv2 support.Network administrators can determine if a server supports SSLv2 with the following command:
>
> - openssl s\_client -connect host:443 -ssl2
>
> #If certificate information is returned, then SSLv2 is supported
>
> **3.2Do not reuse SSL certificates or key material**
> This issue can be mitigated on TLS connections by using unique SSL keys and certificates.
>
> - If possible, do not reuse key material or certificates between SSLv2 and TLS support on multiple servers.
>
> **3.3Monitor network and use firewall rules**
> Network administrators should:
>
> - enabling firewall rules to block SSLv2 traffic
> - monitor logs to look for repeated connection attempts since the attack requires approximately 1000 SSL handshakes
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#a8cbd1cacdda919191e8cbd1cacddadbcdcbdddac1dcd186c5d1) or [[email protected]](/cdn-cgi/l/email-protection#44293d2721363004293d272136306a2b36236a293d) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**4.0 References**
- SSLv2 DROWN Attack: <https://www.us-cert.gov/ncas/current-activity/2016/03/01/SSLv2-DROWN-Attack>
- Vulnerability Note VU#583776: <https://www.kb.cert.org/vuls/id/583776>
- DROWN: Breaking TLS using SSLv2: <https://drownattack.com/drown-attack-paper.pdf>
- DROWN attack shows danger of supporting old SSL v2 protocol: <https://www.feistyduck.com/bulletproof-tls-newsletter/issue13_DROWN_attack.html>
- The drown Attack: <https://drownattack.com>