Cloud sellers who acted on Heartbleed sink when it comes to DROWN

I'd guess the people that acted on Heartbleed disabled SSLv2 entirely, so only the people that ignored Heartbleed are vulnerable to DROWN. Unless I've completely misunderstood the situation, that is.

The German BSI (Federal Office of IT Security) has been contacting the various ISPs / data centres after scanning them and providing lists of probably vulnerable. Intern the ISPs are contacting the relevant server owners. Would be nice to see more of this, even if the initial e-mail suggested that there might have been a security breach and that the server would be shutdown if no action was taken.

I did have to fix one system but was able to track down the relevant instructions pretty easily. It's an older Debian system and gave me another reason to curse "packaged systems". Compiling and installing a new version of openssl was no problem. But, of course, you have to deal with non-standard paths and then configure the relevant services (e-mail, mainly). The server is due for an upgrade to something newer but there are no convenient tools for migrating things like e-mail addresses. :-/

Good place to start if you need to check.

Heartbleed: 1173 to 86; Drown: 653 to 620

See the difference in the starting figures? 520. It likely means that a huge number of providers (cloud or otherwise) were not suspectible to Drown to begin with, because they ditched SSL v2 ages ago -- like any sensible person would have done.

So the majority of those 520 providers were never among the 33 companies which have responded to Drown, because they didn't need to.

You can't take numbers at face value and completely ignore that only stupid providers would still have been suspectible to Drown after it hit the headlines, because SSL v2 and v3 have been known to be unfit for purpose for quite some time now and sensible providers and sys admins would have known that.

Skyhigh Networks' Cloud Security Labs have discredited themselves, and El Reg shares the guilt for believing and blindly printing what the EMEA Marketing Director said...

I'm not sure the downattack site was even accurate to begin with.

It told me that some of our IPs/servers were vulnerable. But we haven't supported or allowed SSLv2 for years.

...a couple of days after it appeared on BBC, checked again and we had supposedly now fixed it, but it was never "not fixed"

Potentially?

"One-third of all HTTPS websites were potentially vulnerable..."

Either they're vulnerable or they're not vulnerable.