Windows vulnerable to FREAK attacks after all
Microsoft has released a security advisory on Thursday, confirming that all supported releases of Microsoft Windows are vulnerable to the recently documented FREAK (Factoring RSA Export Keys) attack.
The FREAK flaw, discovered initially in OpenSSL and Apple’s Secure Transport implementation of SSL and TLS protocols, can be misused to force vulnerable clients and servers to used weak cipher suites. They, in turn, can be broken by determined and resourceful attackers, and this would allow them to intercept data exchanged by users and secure websites. In short, the encrypted connection between the two entities is undermined.
Until yesterday, it was thought that Windows IE users were safe from this bug. Confirmed vulnerable clients were Safari and Chrome for OS X (Google released an fixed version of Chrome for OS X on Thursday), Safari on iOS, Google’s Android browser (a patch is out but it depends on device makers and mobile carriers when it will be pushed out to users), the Blackberry browser. Firefox was – is – safe to use.
Apple announced patches for OS X and iOS for next week.
According to Microsoft’s advisory, the FREAK bug affects the Windows’ Secure Channel (Schannel) component.
“The vulnerability could allow a man-in-the-middle (MiTM) attacker to force the downgrading of the cipher used in an SSL/TLS connection on a Windows client system to weaker individual ciphers that are disabled but part of a cipher suite that is enabled,” they explained.
“Windows servers, with the exception of Windows Server 2003, are not impacted in the default configuration (export ciphers disabled). The cipher management architecture on Windows Server 2003 does not allow for the enabling or disabling of individual ciphers.”
The company is not aware of any public exploitation of the issue. But, as users wait for a patch to be pushed out – Microsoft didn’t specify when – there are workarounds that can be implemented (by tech-savvy users) to help block known attack vectors.
As server operators continue to disable support for these weak export suites, some high-profile sites are stil vulnerable. More information about the flaw, what to do about it, and a list of sites still vulnerable can be found here.
Jayson Street, Infosec Ranger at Pwnie Express, explains the danger of FREAK for businesses:
“First, by giving hackers a temporary in, the FREAK flaw builds on the momentum of Heartbleed and POODLE, which will inspire hackers to look for other easy chinks in the armor of HTTPS connections. This means we’ll see more endpoints being attacked through SSL. Second, most people still think of SSL as secure, so when hackers find these chinks, employees may inadvertently download malware onto their devices through unsecured public connections, and then bring the compromised devices back onto the company network.”
“In response to these new risks, CSOs and CISOs need to understand that their perimeter is only as secure as the software and transportation mechanisms allowed on the internal network. Because SSL is often allowed through the firewall, when it’s compromised, enterprise networks will be breached. Security teams need to ensure that servers are up to date, and that they’re constantly monitoring for new threats to update security protocols before a breach occurs,” he added.