Freak vulnerability alerts from the Department of Homeland Security’s National Cybersecurity and Communications Integration Center are never good news.
Discovered and reported this March 2015, the FREAK (Factoring Attack on RSA-EXPORT Keys CVE-2015-0204) is a weakness in some implementations of SSL/TLS that may allow an attacker to decrypt secure communications between vulnerable clients and servers.
The weakness was actually discovered by researchers at Microsoft Research and also by the team at the French National Institute for Research in Computer Science and Automation (INRIA) and IMDEA Software, Spain.
SSL/TLS, for the record
For the record then (or as a refresher), Secure Sockets Layer (SSL) refers to industry standard cryptographic protocols for securing encrypted links over networked communications i.e. between a web server and a browser. Transport Layer Security (TLS) is a successor to SSL and is also protocol that ensures privacy between applications and users as they interconnect and communicative on the Internet.
Android clients were affected (through OpenSSL) by this vulnerability — and Apple Safari clients were also affected (through TLS/SSL) to the extent that a ‘Man-in-the-Middle’ attack could take place.
Industry reaction has been swift enough and Google has released an updated version of its Android operating system (OS) and Chrome browser for Apple OS X to mitigate the vulnerability. Equally, Computerworld reports that Apple has also secured Safari against the FREAK flaw in both OS X for desktops and iOS for mobile.
“Secure Transport accepted short ephemeral RSA keys, usually used only in export-strength RSA cipher suites, on connections using full-strength RSA cipher suites. This issue, also known as FREAK, only affected connections to servers which support export-strength RSA cipher suites, and was addressed by removing support for ephemeral RSA keys,” stated Apple.
Microsoft also released a Security Advisory that includes a workaround for supported Windows systems. Microsoft’s reminds us that TLS is the only security option available when servers need to prove their identity to anonymous clients.
According to Microsoft, “This [use of TLS] is particularly important for websites that want to participate in e-commerce because it helps protect the transmission of sensitive information such as credit card numbers. TLS assures that the e-commerce customers can be certain of whom they are doing business with because they are given proof of the server’s identity. It also gives the e-commerce server the efficiency of not having to concern itself with authenticating the identity of each of its customers.”
Questions still need to be answered
So is ecommerce broken now, or have the updates fully addressed the problem?
- What did the attack actually do and should we expect another like it?
- Are all browsers affected and should we worry about what appears to be a seriously impactful attack that rendered one of the core encryption layers of the Internet itself powerless?
- Is it the responsibility of the user themselves to fix their machines or is this an administrator level issue?
To answer these questions: no ecommerce isn’t broken, but all users should apply system updates as soon as possible; the attack opened up a route for a hacker to intercept normally-secure HTTPS connections between users’ browsers/online-applications and servers and direct them to weakened encryption so that sensitive data could be stolen or compromised; userscan in fact visit freakattack.com to help determine whether their browsers are vulnerable; and finally, it is a user and an administrator issue i.e. everyone should be aware of this kind of attack.
So are the risks still out there?
“In a world full of untrusted networks, SSL and TLS are what makes modern communication possible. Or rather, that’s the theory. In practice, SSL and TLS have been a more like a work in progress. In part this is because they were developed during an era when modern cryptographic best practices weren’t nailed down yet. But more to the point: it’s because even when the crypto is right, many software implementations still get things wrong,” wrote cryptographer and research professor at Johns Hopkins University Matthew Green on his personal blog.
The points to take away here is that as secure as we make the Internet, cracks and fissures will always appear. As encrypted as our standards and protocols are, they will always need locking down. As tight as any firm’s security procedures are, they will always need constant supervision and updates if they are to stay relevant.
As careful as you think you are being, it’s probably not careful enough — so take a closer look at your security today.
Contact our security experts today to keep your organization and your data safe from the real threats you may face in 2015.
