Tag Archives: FREAK

Una vulnerabilidad crítica de OpenSSL podría permitir a hackers interceptar comunicaciones seguras

Se recomienda a los usuarios hacer la actualización a la última versión de SSL / TLS

Read More

Critical OpenSSL vulnerability could allow attackers to intercept secure communications

Users advised to update to latest version of popular open source implementation of SSL/TLS.Read More

FREAK ????????????????????

      No Comments on FREAK ????????????????????

最近報告された FREAK 脆弱性を悪用すると、攻撃者は、セキュア接続に対して強度が弱く、簡単に復号可能な暗号方式を強制的に使用させることができます。

Read More

The FREAK Vulnerability; What You Need to Know

A new SSL/TLS vulnerability named “FREAK” was identified by several security researchers.

Twitter Card Style: 

summary

A new SSL/TLS vulnerability named “FREAK” was identified by several security researchers. It’s a threat because FREAK allows an attacker to get between a client and server and view what is intended to be a secure and private communication. The vulnerability is primarily due to a bug in OpenSSL client software, but only exploitable on poorly-configured web servers. Both clients and servers are at risk. Web site owners can protect their sites by properly configuring their web servers. End users will need to wait for browser vendors to release new versions that include the OpenSSL bug fix.

Note that this vulnerability is not related to SSL certificates. Your existing certificate will continue to work as intended; no certificate replacement is needed.

Organizations should evaluate their web servers to determine if they are vulnerable.  Symantec expects to offer an easy-to-use check in its SSL Toolbox to allow customers to easily verify that their web sites are safe or vulnerable. This will be announced when available. At the time of this writing, Symantec is evaluating its own systems and no Symantec web servers appear to be vulnerable.

Blue Digital Lock 600X.jpg

Technical Details:

It’s relatively easy to determine if a website is vulnerable, and if so, it’s relatively easy to change the configuration to block any possible attacks. Any type of web server (Apache, IIS, nginx, etc.) may be vulnerable if its configuration allows the use of so-called Export Ciphers. In Apache/OpenSSL documentation, for example, the names of these ciphers all begin with EXP (from https://httpd.apache.org/docs/2.4/mod/mod_ssl.html):

EXP-DES-CBC-SHA

EXP-RC2-CBC-MD5

EXP-RC4-MD5

EXP-EDH-RSA-DES-CBC-SHA

EXP-EDH-DSS-DES-CBC-SHA

EXP-ADH-DES-CBC-SHA

EXP-ADH-RC4-MD5

If a customer’s web server supports these ciphers, the customer must reconfigure the web server by removing these ciphers from the list of supported ciphers, and restart the web server. Although not related to this vulnerability, customers should also disable null ciphers if they are supported, since such ciphers do not provide any encryption of the SSL stream:

NULL-SHA

NULL-MD5

In Windows, the names of export ciphers contain the string “EXPORT”. Here is a list taken from http://support.microsoft.com/kb/245030:

SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA

SSL_RSA_EXPORT1024_WITH_RC4_56_SHA

SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5

SSL_RSA_EXPORT_WITH_RC4_40_MD5

TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA

TLS_RSA_EXPORT1024_WITH_RC4_56_SHA

TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5

TLS_RSA_EXPORT_WITH_RC4_40_MD5

NULL

We advise customers to consult their web server documentation to determine how to view the list of supported ciphers, and how to disable certain ciphers.

Additional guidance from Symantec

FREAK is another reminder that website security is not just about certificates. Symantec has numerous articles and white papers on security best practices and technical areas related to SSL/TLS and code-signing issues.  Please stay tuned to our Connect blog site for up-to-date information on this and other critical vulnerabilities, for other topics related to advanced threat protection, and for security industry news.  Please access our learning center for more resources that can help your organization make critical decisions related to web server security.  For technical details to help with troubleshooting please bookmark our SSL/TLS and code-signing knowledge base.

FREAK vulnerability can leave encrypted communications open to attack

A recently reported flaw lets attackers force secure connections to use a weaker, breakable form of encryption.Read More

Vulnerabilidade FREAK pode deixar comunicações criptografadas abertas a ataques

Uma falha divulgada recentemente permite que atacantes forcem conexões seguras a utilizar uma forma mais fraca de criptografia, que pode ser quebrada.

Read More

Vulnerabilidad FREAK puede dejar las comunicaciones cifradas expuestas a ataques

Una falla reportada recientemente permite a los atacantes forzar las conexiones seguras a usar un método de cifrado más débil y quebrantable.

Read More