Servers that haven’t been configured to block export ciphers could be targeted by FREAK man-in-the-middle attacks.
TL;DR: A backward-compatibility feature built into the SSL/TLS encryption protocol as a result of 20-year-old software-export controls is being leveraged by hackers to launch man-in-the-middle attacks on web servers. A recent survey found that many popular cloud services remained vulnerable to FREAK attacks more than 24 hours after the glitch was disclosed.
A vulnerability recently disclosed in the SSL/TLS encryption method has left a great number of web servers vulnerable to a man-in-the-middle attack. Researchers at Skyhigh Networks report that as of noon PST on March 4, 2015, 24 hours after the FREAK vulnerability was first reported, 766 cloud services were still at risk, based on the company’s analysis of 10,000 services. A running tally of the vulnerable sites is maintained on the Freak Attack site.
The Register’s John Leydon explains in a March 5, 2015, post that the average company uses 122 of the services. While there have been no reports of attacks targeting the FREAK vulnerability, researchers demonstrated how easy such an attack would be by breaking into the NSA’s public-facing site. Techworm’s Vijay reports in a March 5, 2015, article that the researchers needed only $104 and eight hours of computing time on Amazon’s cloud computing service to compromise the NSA site.
According to Symantec technical director Rick Andrews, any web server whose configuration allows use of export ciphers is vulnerable to FREAK. Andrews is quoted by Computer Business Review’s Jimmy Nicholls in a March 5, 2015, article.
FREAK stands for “Factoring attack on RSA-Export Keys.” It allows hackers to force browsers to downgrade to weaker 512-bit RSA encryption from the current default 2,048-bit keys, or the intermediate 1,024-bit keys. Computerworld’s Jeremy Kirk explains in a March 3, 2015, article that the U.S. government’s export restrictions from the 1990s prohibited export of software supporting strong encryption. Even after the restrictions were lifted, the export mode feature remained in the SSL/TLS protocol in order to maintain backward-compatibility with old products.
Cryptography researchers claim it would take only seven hours and the equivalent of 75 PCs to break 512-bit encryption, but millions of PC equivalents and months or years to break 1,024-bit or 2,048-bit encryption. Source: Matthew D. Green, Johns Hopkins University, via the Washington Post
How to patch web servers to prevent a FREAK attack
From a client perspective, the simplest way to guard against a FREAK-based attack is to avoid using Apple’s Safari browser or the browser built into Android devices. Apple plans to issue a FREAK patch for Safari in the second week of March, and Google reports having pushed a patch to its Android partners. FREAK doesn’t affect recent versions of the Google Chrome, Internet Explorer, and Firefox browsers.
In a March 2, 2015, post, Akamai’s Bill Brenner describes the OpenSSL command you can run to determine whether a web server is vulnerable to an export-cipher attack:
Running this OpenSSL command should generate an “alert handshake failure” message, which indicates the server is not vulnerable to an export-cipher attack. Source: Akamai
Substitute your domain name for “www.akamai.com”. If you see an “alert handshake failure” message, the host is protected against a FREAK attack. Skyhigh Networks recommends that administrators disable support for all known ciphers and enable forward secrecy. Instructions for doing so are available on the Mozilla site.
State Machine Attacks on TLS (SMACK) offers a video demonstration of a FREAK attack as well as a list of vulnerable TLS client libraries.
Security is hard-wired into the new Morpheus Virtual Appliance. Your data is protected at the persistence layer via user authentication and Access Control Lists (ACLs). With the Morpheus database-as-a-service (DBaaS) you can provision, deploy, and monitor your MongoDB, Redis, MySQL, and ElasticSearch databases from a single point-and-click console. Morpheus lets you work with SQL, NoSQL, and in-memory databases across public, private, and hybrid clouds in just minutes. Each database instance you create includes a free full replica set for built-in fault tolerance and fail over.
In addition, the service allows you to migrate existing databases from a private cloud to the public cloud, or from public to private. A new instance of the same database type is created in the other cloud, and real-time replication keeps the two databases in sync. Visit the Morpheus site for pricing information and to create a free account.
