bugtraq - *.Shell.com Port 443 DROWN decryption attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201604200745.u3K7jaZn029774@sf01web1.securityfocus.com>
Date: Wed, 20 Apr 2016 07:45:36 GMT
From: shell@...ll.com
To: bugtraq@...urityfocus.com
Subject: *.Shell.com Port 443 DROWN decryption attack

Login: 

https://prom3.shell.com/(S(qxq1noy1f4gl4g45kbggia45))/Common/Login.aspx

Vulnerability

An attacker can decrypt traffic and get login and passwords


Signatures

584e3a64196dc662286922fc82fa915f1ee0cc46ab5400c347f529ab4eb46c67
prom3.shell.com
d50be93e35266af753e288af8f4f3eb96986187264a44c6c0d741d051443b1cc

443.https.ssl_2.certificate.parsed.fingerprint_sha256: 5c3bd6ba5b682650ceba4e167023d48e4627a2d7c2005f7f1fdad6f45b3e53a6 

&#57347; 443.https.tls.certificate.parsed.fingerprint_sha256: 5c3bd6ba5b682650ceba4e167023d48e4627a2d7c2005f7f1fdad6f45b3e53a6