Researchers warn sites such as Yahoo, BuzzFeed and Flickr would be susceptible to attack, and credit card info, passwords and other data could be compromised

Security researchers have developed a method of attacking “secure” connections that can be used to intercept and decrypt information being transmitted to some of the world’s most popular email, news and entertainment services.

The researchers, made up of a team from public universities, Google, and a number of groups devoted to the development of open source projects, say the attack relies on a flaw in an old piece of encryption technology.

The Drown attack method, or “Decrypting RSA with Obsolete and Weakened eNcryption”, could affect up to one third of all websites that use secure connections – addresses prefixed by “https”. It means the information visitors submit could be accessed and decrypted while it travels over the internet.

Yahoo, BuzzFeed, Flickr and Samsung.com would all be susceptible, according to the researchers, as would a large number of the world’s top 10,000 websites. Credit card data, passwords and other information handled by these websites could be compromised.

The team compared the Drown attack to previously revealed attacks called Freak, Poodle and Logjam, all of which were made possible by 1990s export laws that required US companies to deliberately weaken encryption algorithms used in products available overseas.

These restrictions were eventually lifted, but the damage had already been done: now, two decades later, the compromised security can still be exploited.

“These three attacks targeting different flaws from export-grade cryptography from the 90s are the best natural experiment we have about the long-term damage to security that can come from deliberately weakening cryptography,” said Nadia Heninger, an assistant computer and information science professor at the University of Pennsylvania and a member of the Drown attack research team.

These laws, much like the current fight between Apple and the FBI over security features used to protect iPhone data, resulted from the “crypto wars” between the public and private sectors. The US government has often feared that encryption allows criminals to “go dark”, while security experts maintain that it’s not possible to create vulnerabilities that only one group, no matter how well-intentioned, will be able to use.

“I hope that the lessons we can draw from previous attempts to backdoor crypto get through to policymakers, who need to be including technologists in decisions about cryptography and security regulations,” she said.

“In the context of the current debates about backdooring cryptography and lawful access to encrypted data, I think there has been too much focus on immediate political context and not enough focus on the long-term technological ramifications of some of the proposals.

“Empirically, it seems to be incredibly difficult to implement back-doored cryptography securely, so these designs result in even more vulnerabilities present in common software.”

Government agencies sometimes use the term “Nobus”, short for “Nobody but us”, to explain their desire for weakened cryptography.

“This means the NSA and the US intelligence community are comfortable with back doors in software as long as they were the only ones who could use those back doors,” said Christopher Soghoian, principal technologist for the American Civil Liberties Union.

“But because there’s no sell-by date, because the software stays in use long after it was taken out of circulation, the Nobus backdoors become exploitable by everyone. This is clear evidence that the US government should tread lightly when it comes to mandating weaknesses in devices and software because it will come back to bite us in the ass,” he said.

The Drown attack research team says the disclosure of the method wasn’t deliberately made the same morning Apple and the FBI argued their case in front of Congress. But several members of the team say they want lawmakers to pay attention to the disclosure as they consider the fight over iPhone security.

Fixed, but not forgotten

The Drown attack only works if a server is compatible with an old version of the secure sockets layer (SSL) protocol that uses the weakened encryption algorithms. Modern versions of the protocol don’t support those algorithms, yet many servers maintain the capability of using that protocol if they are asked to.

So while the latest version of SSL won’t allow the attack, and the ability to switch on support for the old version has been removed, it will take time for all servers using the old version to be updated. The researchers say they will not release the code for the attack because there are still too many vulnerable sites.

A member of the research team called this a “one bad apple spoils the bunch” situation. Considering the connection to Apple’s role in the new crypto wars, the analogy seems apt.