Researchers David Adrian and Alex Halderman receive Pwnie Award for work on DROWN attack

A research team that includes CSE PhD student David Adrian and Prof. J. Alex Halderman has been awarded the Pwnie Award for Best Cryptographic Attack at the Black Hat conference for their work on the DROWN attack.

DROWN allows attackers to break encryption used to protect HTTPS websites and read or steal sensitive communications, including passwords, credit card numbers, trade secrets, or financial data. The researchers will present this attack this week at the 25th USENIX Security Symposium in their paper, DROWN: Breaking TLS using SSLv2.

In the paper, Adrian and the researchers introduce the attack, which exploits multiple unnoticed flaws in SSLv2, a 1990s-era predecessor to the modern TLS protocol, to develop a new and stronger variant of the Bleichenbacher attack. Today, many servers and clients use TLS, but they also support SSLv2, which leaves them vulnerable to the attack.

The researchers found that 33% of all HTTPS servers are vulnerable, and there are two ways that a server can be exposed to the attack: if the server allows SSLv2 connections, and if its private key is used on any other server that allows SSLv2 connections.

To protect against DROWN, the researchers recommend that the server’s private keys are not used anywhere with server software that allows SSLv2 connections. They also provide instructions on how to disable SSLv2 on the DROWN attack website.

David Adrian also presented a retrospective of DROWN and two other attacks studied in his recent research—FREAK and Logjam—at the Black Hat security conference in Las Vegas. Each of the vulnerabilities was an unanticipated side-effect of U.S. government regulations from the 1990s, which limited the strength of cryptography that could be exported from the United States in order to ensure that U.S. intelligence agencies could circumvent it.

Twenty years after these export restrictions were relaxed, they nonetheless contributed to security problems that affected about a third of all secure websites globally. According to Adrian, “these experiences provide an important historical precedent for the current ‘going dark’ debate about whether law enforcement should have backdoor access to encrypted data,” such as the recent dispute between Apple and the FBI surround the cryptography used on iPhones. The attacks, he says, demonstrate that “deliberately weakened cryptography can create risks for everyone’s security.”

DROWN was also named a finalist for the 2016 Facebook Internet Defense Prize. The Internet Defense Prize recognizes and rewards research that meaningfully makes the internet more secure. Created in 2014, the award is funded by Facebook and offered in partnership with USENIX to celebrate contributions to the protection and defense of the Internet.

About the Pwnie Awards

The Pwnie Awards is an annual awards ceremony celebrating the achievements and failures of security researchers and the security community. The tenth annual ceremony took place on Aug 3rd, 2016 in Las Vegas at the BlackHat USA security conference.