The “FREAK” Virus Works on Windows
Windows is working on a patch, but be careful in the interim!
Stop the presses: HTTPS-crippling “FREAK” bug affects Windows after all
Ars Technica – By: Dan Goodin – Computers running all supported versions of Microsoft Windows are vulnerable to ‘FREAK,’ a bug disclosed Monday that for more than a decade has made it possible for attackers to decrypt HTTPS-protected traffic passing between vulnerable end-users and millions of websites.
Microsoft confirmed the vulnerability in an advisory published Thursday. A vulnerability-scanning service at FREAKAttack.com, a site that offers information about the bug, confirmed the advisory, showing that the latest version of IE 11 running on a fully patched Windows 7 machine was susceptible. Previously, it was believed that the Windows system was immune to the attacks.
FREAK attacks—short for Factoring attack on RSA-EXPORT Keys—are possible when an end-user with a vulnerable device connects to a vulnerable HTTPS-protected website. Vulnerable sites are those configured to use a weak cipher that many presumed had been retired long ago. In analyses immediately following Monday’s disclosure of FREAK, it was believed Android devices, iPhones and Macs from Apple, and smartphones from Blackberry were susceptible. The addition of Windows dramatically increases the number of users known to be vulnerable.
Attackers who are in a position to monitor traffic passing between vulnerable users and vulnerable servers can inject malicious packets into the flow that will cause the two parties to use a weak 512-bit encryption key while negotiating encrypted Web sessions. Attackers can then collect some of the resulting exchange and use cloud-based computing from Amazon or other services to factor the website’s underlying private key. The process requires about seven hours and $100. From that point on, attackers on a coffee-shop hotspot, rogue employees working at an ISP, or nation-state-sponsored hackers can masquerade as the official HTTPS-protected website, a coup that allows them to read or even modify data as it passes between the site and the end-user.
Meanwhile, Android and Apple devices
On Thursday, Google developers released an updated version of Chrome for Mac that can’t be forced to use the weak 512-bit cipher, effectively closing the FREAK hole when OS X users are on the Google browser. At the time this post was being prepared, Chrome for Android remained vulnerable, and Google officials have yet to provide any public estimate on when a fix would be available. Apple officials have said patches for OS X and iOS would be released next week. Microsoft’s advisory provided no estimate on when a patch would be available, either. In the interim, people on vulnerable devices should consider using Firefox, which over the past two days has consistently been labeled as safe by the FREAKAttack site.
In recent weeks, security researchers scanned more than 14 million HTTPS-protected websites and found that 36 percent of them supported the weak cipher, meaning they are vulnerable to the attack. As of Thursday morning, vulnerable sites included AmericanExpress.com, Groupon.com, Bloomberg.com, and many more. Microsoft’s advisory offers several work-arounds for more technically inclined readers, but some of them will prevent IE from connecting as expected to certain websites.
Despite the large number of sites and end-user devices known to be vulnerable, there has been considerable debate among security professionals about just how critical the threat posed by FREAK is. Support for the argument the threat is low is the fact that it’s hard or impossible for adversaries to carry out FREAK attacks remotely or in mass numbers. Additionally, Google, Facebook, and most other large sites aren’t vulnerable. These considerations and the perception the threat is low are likely contributing to the slow pace of patches coming from Apple, Google, and Microsoft.
Still other researchers say the severity is much higher. Besides the millions of websites and incomprehensibly high number of end-user devices now known to be vulnerable, other reasons to think FREAK is severe is the fact that it has existed for a decade. That means it’s possible malicious attackers have known about and exploited it for years already.”