THE SSL/TLS (Transport Security Layer) FREAK VULNERABILITY

How secure is HTTPS? Not as good as experts claim it to be if you be believe a new research. The latest SSL/TLS vulnerability dubbed as 'FREAK', have the ability to intercept HTTPS connections between the servers and the clients & force them to use a certain "export-grade" cryptography which can easily be tinkered or decrypted. The vulnerability has been dubbed 'FREAK' for Factoring RSA Export Keys. The study reveals glaring holes in the security as it demonstrates how easy is it to force a browser to switch to a weaker encryption & then exploit it in the course of next few hours. As soon as it gets cracked the hackers can run riot. All the activities and private information of a user becomes vulnerable if hackers manage to crack the code using the FREAK vulnerability.

"The problem illuminates the danger of unintended security consequences at a time when top U.S. officials, frustrated by increasingly strong forms of encryption on smartphones, have called for technology companies to provide doors into systems to protect the ability of law enforcement and intelligence agencies to conduct surveillance " - Washington Post.

The researchers are stunned by the existence of issues with export-grade encryption & have named the attack as "FREAK" or Factoring attack on RSA-EXPORT Keys. Nadia Heninger, a cryptographer from University of Pennsylvania claimed that she can crack the export-grade encryption key roughly under 7 hours using the systems on Amazon Web Service. The attacks are mainly similar to what we know as "Man-In-The-Middle" (MITM) attack where hackers can make even the encrypted traffic very easy to read. There is no real estimates about the penetration of hackers on the internet using the "Man-In-The-Middle" attack as various government intelligence agencies use this technique for surveillance for national security.

Technical Details

The websites which are currently being supported by RSA export cipher suites(eg, TLS_RSA_EXPORT_WITH_DES40_CBC_SHA) with HTTPS connections are most vulnerable to these attacks being intercepted by hackers. The ongoing research on Alexa websites that support any kind of RSA export cipher suites reveal that many top websites remain vulnerable to FREAK attacks.

Damages

"This is a very interesting problem that shows how we mustn't be complacent about these older technologies, even though we think they are not going to be used," said Ivan Ristic, Qualys director of application security research. "This attack seems fairly easy, conceptually  they [the researchers] cite 'about 7.5 hours for $104 in EC2 time' to break a key. Then they need to find a vulnerable client."

"In practice, I don't think this is a terribly big issue, but only because you have to have many ducks in a row," he said. "That is: 1) find a vulnerable server that offers export cipher suites; 2) it should reuse a key for a longish time; 3) break key; 4) find vulnerable client; 5) attack via MITM (easy to do on a local network or wifi; not so easy otherwise). There's a good lesson here, and that's don't enable technologies that you don't want to see used, even if you don't really think they will be used."

"I would not freak out too much as must vendors are quickly patching this bug," added Greg Martin, CTO of ThreatStream. "With that said, it's yet another reminder that there are still many serious bugs in core software, like Shellshock and now FREAK which are still dormant in many of the key software components powering the Internet. Vendors have a responsibility to proactively test not just their own code but third party code and open source components for such vulnerabilities to protect their users."

For a full list of websites affected due to FREAK Vulnerability, checkout this website. The websites are vulnerable as of 1 AM EST March 3.

The biggest names to take a hit due to these attacks are the 2 tech giants Apple & Google. The smartphones such as iPhone by Apple & most Android phones remains vulnerable to FREAK attacks. Often, they use unpatched OpenSSL which is main reason they are vulnerable to this attack.

"Apple is preparing a security patch that will be in place next week for both its computers and its mobile devices, said company spokeswoman Trudy Miller ", Reuters.

While Google browser that comes preinstalled in Android devices remains vulnerable, the Chrome browser is fairly secure of the FREAK bug.

Also, reportedly, Google spokesperson said Tuesday that it has developed a patch for the Android operating systems browser and has provided it to partners.

"The company encourages all websites to disable support for export certificates, and that Android's connections to most websites - including Google sites and others without export certificates - are not subject to this vulnerability.", he added.

Secondly, many embedded systems and other software products that use TLS without disabling the vulnerable cryptographic suites, are also vulnerable to FREAK Vulnerability.

Mitigation

• OpenSSL has already patched the issue as reported on their website.
• Mozilla has come up with a quick Incident Response, providing a Guide and a SSL Configuration Generator, which will generate known good configurations for common servers.
• Also, you can examine whether your site using the SSL Labs' SSL Server Test.