Exam 312-50v12 topic 1 question 51 discussion

B. DROWN attack ------------------------------- A. Padding oracle attack: Exploiting padding to decrypt data. B. DROWN attack: Decrypting SSL/TLS communications through SSLv2 vulnerability. C. DUHK attack: Exploiting weak random number generators to compromise encryption. D. Side-channel attack: Extracting sensitive data through unintended channels, such as power consumption, electromagnetic radiation, or timing variations, to infer sensitive data or cryptographic keys.

B. DROWN attack Explanation: The scenario describes a vulnerability where the web server permits SSLv2 connections and the same private key certificate is used on a different server that also allows SSLv2 connections. This is a security weakness because SSLv2 is a deprecated and insecure protocol that is susceptible to attacks. One attack that can be performed by exploiting this vulnerability is the DROWN (Decrypting RSA with Obsolete and Weakened eNcryption) attack. This attack allows an attacker to decrypt intercepted SSL traffic by exploiting a vulnerability in the SSLv2 protocol. In the DROWN attack, the attacker first sends specially crafted packets to the SSLv2 server to obtain data encrypted with the server's private key. The attacker can then use this data to decrypt intercepted SSL traffic that was encrypted with the same private key.

B. DROWN attack

B. DROWN attack