<?xml version="1.0" encoding="UTF-8" standalone="yes"?><oembed><version><![CDATA[1.0]]></version><provider_name><![CDATA[Gigaom]]></provider_name><provider_url><![CDATA[http://gigaom.com]]></provider_url><author_name><![CDATA[David Meyer]]></author_name><author_url><![CDATA[http://search.gigaom.com/author/superglaze/]]></author_url><title><![CDATA[Windows users are also vulnerable to FREAK snooping attacks]]></title><type><![CDATA[link]]></type><html><![CDATA[<p>The &#8220;FREAK&#8221; vulnerability that downgrades and weakens secure web connections doesn&#8217;t just affect <a href="https://gigaom.com/2015/03/03/decade-old-freak-bug-affects-google-and-apple-device-users/">Google and Apple users</a> &#8212; according to a <a href="https://technet.microsoft.com/en-us/library/security/3046015?f=255&amp;MSPPError=-2147217396">security advisory</a> from Microsoft, all supported versions of Windows are vulnerable too.</p>
<p>FREAK (Factoring attack on RSA-EXPORT Keys) is a recently discovered <a href="https://freedom-to-tinker.com/blog/felten/freak-attack-the-chickens-of-90s-crypto-restriction-come-home-to-roost/">hangover from the early 90s</a>, when the U.S. government banned the export of most software that used strong encryption. The SSL web security protocol was for that reason built with a special mode that uses key lengths <a href="https://blogs.akamai.com/2015/03/cve-2015-0204-getting-out-of-the-export-business.html">considered weak today</a>. The law was changed but the weak cipher suites remain, and although most modern browsers are supposed to avoid them like the plague, a widespread bug means they don&#8217;t always do that.</p>
<p>The FREAK flaw allows <a href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack">&#8220;man-in-the-middle&#8221;</a> snoopers to <a href="http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html">downgrade a session&#8217;s security</a> to that mode – as long as the browser is vulnerable and the server accepts those weak old cipher suites &#8212; then crack the keys and spy away.</p>
<p>When the flaw was publicized earlier this week, it was Apple&#8217;s Safari browser and the stock Android browser that were on the firing line for being vulnerable, endangering those users who communicate with servers that accept &#8220;export-grade&#8221; encryption – <a href="https://freakattack.com/">apparently</a> a whopping third of servers with browser-trusted certificates. But it turns out the list of affected browsers and systems is way longer than that.</p>
<p>The big one is Windows. In pretty much every version of Windows that&#8217;s out there, Internet Explorer and whatever else uses the Schannel security package are vulnerable to the FREAK attack.</p>
<p>In its advisory, Microsoft said:</p>
<blockquote id="quote-we-are-actively-work"><p>We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers.</p>
<p>Upon completion of this investigation, Microsoft will take the appropriate action to help protect customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.</p></blockquote>
<p>Per the researchers who brought this all to our attention, here&#8217;s the current list of browsers that need patching:</p>
<ul>
<li>Internet Explorer</li>
<li>Chrome on OS X (patch available)</li>
<li>Chrome on Android</li>
<li>Safari on OS X (patch expected next week)</li>
<li>Safari on iOS (patch expected next week)</li>
<li>Stock Android browser</li>
<li>BlackBerry browser</li>
<li>Opera on OS X</li>
<li>Opera on Linux</li>
</ul>
<p>As a Firefox user, I&#8217;m feeling slightly smug this week &#8212; the researchers&#8217; <a href="https://freakattack.com/clienttest.html">FREAK test tool</a> just gave my browser a clean bill of health, and told me my never-used IE installation is vulnerable. Not too smug though, given the impact on other Windows software.</p>
<p>Good thing the anti-strong-encryption nonsense that caused this mess is a relic of past decades, eh? <a href="https://gigaom.com/2015/01/23/defending-encryption-doesnt-mean-opposing-targeted-surveillance/">Oh wait…</a></p>
]]></html><thumbnail_url><![CDATA[https://i1.wp.com/gigaom2.files.wordpress.com/2014/05/shutterstock_132797318.jpg?fit=440%2C330&quality=80&strip=all]]></thumbnail_url><thumbnail_height><![CDATA[330]]></thumbnail_height><thumbnail_width><![CDATA[330]]></thumbnail_width></oembed>