FREAK encryption flaw leaves millions of Apple & Android users exposed
Tech firms are rushing to fix a disastrous security flaw dubbed ‘FREAK’, stemming from the US government’s requirement of lower encryption standards, that for over a decade left millions of users visiting 'secured' websites exposed to potential attacks.
Cyber security experts have discovered a massive flaw that allows attackers to decrypt HTTPS-protected traffic passing between millions of websites worldwide and users of vulnerable devices, including Android and Apple smartphones and tablets.
Apple already announced that it plans to issue a patch for iOS and OS X next week while Google said they’ve already issued a patch to hardware partners. Windows and Linux end-user devices were not believed to have been affected.
Researchers found that some 36 percent of websites that use SSL or TLS protocols, including government ones, are vulnerable and could be tricked into setting up a connection through weak encryption keys, also known as the export-grade key or 512-bit RSA keys – the design was approved by the US government for export overseas some three decades ago.
“The export-grade RSA ciphers are the remains of a 1980s-vintage effort to weaken cryptography so that intelligence agencies would be able to monitor. This was done badly. So badly, that while the policies were ultimately scrapped, they’re still hurting us today,” cryptographer Matthew Green of Johns Hopkins University wrote in a blog explaining the threat of the attack.
What You Need to Know About the FREAK SSL Vulnerability | http://t.co/CxaG5UT0JM#FREAK#InfoSecpic.twitter.com/HYgdfntNa2
— ◉ Daniel Miessler (@DanielMiessler) March 3, 2015
Dubbed the FREAK, which is short for ‘Factoring Attack on RSA-EXPORT Keys’, the method potentially allows the attacker to decode the website’s private key and browse encrypted traffic or use it for man-in-the-middle attacks.
The entire weakness of the encryption design stems from Washington’s effort to regulate the export of products utilizing “strong” encryption. Now three decades later, as the export-grade encryption standard was never removed, such weak encryption could be pretty easily cracked, leaving clients’ devices potentially exposed.
“This bug causes them to accept RSA export-grade keys even when the client didn't ask for export-grade RSA,” Green wrote. “The impact of this bug can be quite nasty – it admits a 'man in the middle' attack whereby an active attacker can force down the quality of a connection, provided that the client is vulnerable and the server supports export RSA.”
The FREAK is one of several SSL-related vulnerabilities disclosed Tuesday by a research team that included experts from INRIA Paris-Rocquencourt and Microsoft. Security experts also compiled a list of vulnerable websites that included those such as AmericanExpress.com, NSA.gov, and FBI.gov.
