We last discussed SSLv2 support on internet-exposed web servers about a year ago, when we discovered that there were still about 450 thousand web servers that supported this protocol left on the internet[1]. We also found that a significant portion of these servers was located in Kazakhstan, Tunisia and in the U.S.[2]

Since we are now less than a year from the 30th birthday of the SSL 2.0 protocol, I thought it might be interesting to revisit this topic and take a look at how the situation has changed over the past 12 months. As before, we will mostly use data gathered from Shodan using my TriOp tool to do so.

At first glance, it might seem that both the percentage of web servers supporting the aforementioned protocol, as well as the absolute number of them, have continued to decrease at a reasonable rate…

Nevertheless, a closer look shows, that although the trendlines still show a decreasing trend in the past twelve months, at this point in time, there seem to be only a slightly lower percentage of web servers that support SSL 2.0 than there were a year ago (0.319% twelve months ago vs. 0.307% now), and the overall number of servers seems to have actually  increased (from approximately 464 thousand a year ago to 492 thousand now).

This seems to have been caused by a steady increase in detections of SSLv2-enabled servers by Shodan in the past three months, and we can’t be certain whether this reflects the real state of affairs (i.e., if there are more servers that support SSL 2.0 than there were a year ago), or whether this is the result of improved detection capabilities on Shodan’s part (i.e., if Shodan sees “more” of what there actually is than it did a year ago).

In any case, as we mentioned before, the overall downwards trend seems to be holding, and the percentages are getting better.

This is also supported by the latest statistics from Qualys SSL Labs[3], which show that the service has only detected SSLv2 being supported on 171 sites (0.1% of all servers) it scanned in the course of May 2024, which is significantly lower than what we saw last year (248 sites/0.2% of all scanned servers).

To sum up, the trend of leaving the long-deprecated SSL 2.0 behind us is continuing, even if it has slowed down somewhat in the last year. Nevertheless, the fact that we still have between 450 and 500 thousand web servers on the internet, which support this protocol, is potentially problematic.

The issue is not really with the fact that SSL 2.0 is being supported by the servers, since probably no modern browser is even capable of using this protocol (at least, not in a default configuration), but it lies it the fact that if a server does still support this protocol, it is probably significantly outdated, and, thus, most likely, vulnerable.

Though, this is, of course, just the tip of the proverbial iceberg, when it comes to the larger technical debt that we, as a modern society, have created for ourselves, and which might come back to bite us at some point in the future…

[1] https://isc.sans.edu/diary/After+28+years+SSLv2+is+still+not+gone+from+the+internet+but+were+getting+there/29908
[2] https://isc.sans.edu/diary/Kazakhstan+the+worlds+last+SSLv2+superpower+and+a+country+with+potentially+vulnerable+lastmile+internet+infrastructure/29988
[3] https://www.ssllabs.com/ssl-pulse/

-----------
Jan Kopriva
@jk0pr | LinkedIn
Nettles Consulting

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

A Microsoft software engineer accidentally published internal PlayReady DRM source code on a publicly accessible developer forum. The 4GB data leak contains sufficient information to compile the required DLL from the source code, potentially opening the door for reverse engineering or cracking of the DRM protection technology. PlayReady, introduced in 2007, is Microsoft's platform-independent digital rights management (DRM) system used for protecting media files. It includes encryption, output protection, and digital rights management features. The leak could have significant implications for the security of this widely-used technology.

PlayReady DRM Internal Code Leak

In early June, a Microsoft engineer had published information about an Apple TV service crash on a Surface Pro 9 device in a public forum. The shared data included a 771MB file attachment that revealed 4GB of internal code related to Microsoft PlayReady upon extraction. [caption id="attachment_79066" align="alignnone" width="1920"] Original Post Before Deletion (Source: security-explorations.com)[/caption] The leaked PlayReady data is said to include: 1. WarBird configurations for creating the PlayReady library 2. WarBird libraries for code obfuscation functions 3. Libraries with symbolic information related to PlayReady [caption id="attachment_79063" align="alignnone" width="1428"] Partial Directory View of Leaked Data (Source: security-explorations.com)[/caption]

HD Keys Could Be Decrypted

Researchers from cybersecurity company AG Security Research Lab managed to successfully build the required Windows PlayReady DLL library from the leaked internal code, aided by step-by-step instructions provided by another user on the same forum. Their investigation uncovered several deficiencies in Protected Media Path (PMP) components of PlayReady, which could be exploited to access plaintext content keys secured by the system on Windows 10 and 11 systems. The researchers demonstrated that these extracted keys could successfully decrypt high-definition movies protected by PlayReady. Notably, the vulnerability persists even on systems with hardware DRM capabilities, as this feature can be easily disabled. The root cause appears to lie in the software DRM implementation used by default on Windows 10 systems without hardware DRM capability. Given that Windows 10 still holds a 69% market share worldwide, this vulnerability could potentially affect a significant number of users until the operating system's retirement in October 2025. The team also demonstrated that the technique used to extract plaintext values of content keys could work for other platforms relying on SW Microsoft PlayReady technology in a Windows OS environment.

Implications and Microsoft's Response

The researchers had notified Microsoft about the leak on June 12, 2024. While Microsoft removed the forum post within 12 hours, the download link reportedly remained active. On June 26, MSRC stated to the researchers that it had conducted an investigation and determined that the incident was not a vulnerability to service as the post had already been taken down. The researchers confirmed that the download link no longer remains active. The incident highlights the ongoing challenges in maintaining the security and secrecy of DRM implementations. It also underscores the importance of adhering to guidelines for handling sensitive information in public forums, as the leak violated Microsoft's own guidelines for posting link reproduction information publicly. These guidelines specify:

• All information in reports and any comments and replies are publicly visible by default.
• Don't put anything you want to keep private in the title or content of the initial report, which is public.
• To maintain your privacy and keep your sensitive information out of public view, exercise caution.

Major Streaming Services Potentially Affected

The same research team had earlier tested Microsoft's Protected Media Path and had discovered several streaming platforms were affected by vulnerabilities within the environment: Canal+ Online, Netflix, HBO Max, Amazon Prime Video, Sky Showtime, and others. DRM protection is crucial to the video streaming industry, which is valued at $544 billion, making this security breach a matter of serious concern. Microsoft reportedly demonstrated interest in a full disclosure of the stated vulnerabilities and technical details along with Proof of Concept over its MSRC channel, offering potential rewards for the disclosure. However, the researchers declined, as they felt a full disclosure would have to include a commercial agreement, would jeopardize their own confidential technology and tools along with future research on the Windows operating system. The researchers also believed that Microsoft should focus on conducting a more comprehensive review of its Protected Media Path environment, which could result in the discovery and fixing of additional issues rather than focusing on a single exploit.   Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.