FREAK

Last updated
FREAK
CVE identifier(s) CVE- 2015-0204 (OpenSSL),

CVE- 2015-1637 (Schannel),

CVE- 2015-1067 (Secure Transport)
Date discoveredMarch 3, 2015;9 years ago (2015-03-03)
Discoverer IMDEA Software Institute, INRIA, Microsoft Research
Affected softwareClient TLS libraries (including OpenSSL, Schannel and Secure Transport)

FREAK ("Factoring RSA Export Keys") is a security exploit of a cryptographic weakness in the SSL/TLS protocols introduced decades earlier for compliance with U.S. cryptography export regulations. These involved limiting exportable software to use only public key pairs with RSA moduli of 512 bits or fewer (so-called RSA EXPORT keys), with the intention of allowing them to be broken easily by the National Security Agency (NSA), but not by other organizations with lesser computing resources. However, by the early 2010s, increases in computing power meant that they could be broken by anyone with access to relatively modest computing resources using the well-known Number Field Sieve algorithm, using as little as $100 of cloud computing services. Combined with the ability of a man-in-the-middle attack to manipulate the initial cipher suite negotiation between the endpoints in the connection and the fact that the finished hash only depended on the master secret, this meant that a man-in-the-middle attack with only a modest amount of computation could break the security of any website that allowed the use of 512-bit export-grade keys. While the exploit was only discovered in 2015, its underlying vulnerabilities had been present for many years, dating back to the 1990s. [1]

Contents

Vulnerability

The flaw was found by researchers from IMDEA Software Institute, INRIA and Microsoft Research. [2] [3] The FREAK attack in OpenSSL has the identifier CVE - 2015-0204. [4]

Vulnerable software and devices included Apple's Safari web browser, the default browser in Google's Android operating system, Microsoft's Internet Explorer, and OpenSSL. [5] [6] Microsoft has also stated that its Schannel implementation of transport-layer encryption is vulnerable to a version of the FREAK attack in all versions of Microsoft Windows. [7] The CVE ID for Microsoft's vulnerability in Schannel is CVE - 2015-1637. [8] The CVE ID for Apple's vulnerability in Secure Transport is CVE - 2015-1067. [9]

Sites affected by the vulnerability included the US federal government websites fbi.gov, whitehouse.gov and nsa.gov, [10] with around 36% of HTTPS-using websites tested by one security group shown as being vulnerable to the exploit. [11] Based on geolocation analysis using IP2Location LITE, 35% of vulnerable servers are located in the US. [12]

Press reports of the exploit have described its effects as "potentially catastrophic" [13] and an "unintended consequence" of US government efforts to control the spread of cryptographic technology. [10]

As of March 2015, vendors were in the process of releasing new software that would fix the flaw. [10] [11] On March 9, 2015, Apple released security updates for both iOS 8 and OS X operating systems which fixed this flaw. [14] [15] On March 10, 2015, Microsoft released a patch which fixed this vulnerability for all supported versions of Windows (Server 2003, Vista and later). [16] Google Chrome 41 and Opera 28 has also mitigated against this flaw. [3] Mozilla Firefox is not vulnerable against this flaw. [17]

The research paper explaining this flaw has been published at the 36th IEEE Symposium on Security and Privacy and has been awarded the Distinguished Paper award. [18]

See also

Related Research Articles

<span class="mw-page-title-main">HTTPS</span> Extension of the HTTP communications protocol to support TLS encryption

Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It uses encryption for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL). The protocol is therefore also referred to as HTTP over TLS, or HTTP over SSL.

Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securing HTTPS remains the most publicly visible.

<span class="mw-page-title-main">Daniel J. Bernstein</span> American mathematician, cryptologist and computer scientist (born 1971)

Daniel Julius Bernstein is an American mathematician, cryptologist, and computer scientist. He is a visiting professor at CASA at Ruhr University Bochum, as well as a research professor of Computer Science at the University of Illinois at Chicago. Before this, he was a visiting professor in the department of mathematics and computer science at the Eindhoven University of Technology.

In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the validity of a public key. The certificate includes the public key and information about it, information about the identity of its owner, and the digital signature of an entity that has verified the certificate's contents. If the device examining the certificate trusts the issuer and finds the signature to be a valid signature of that issuer, then it can use the included public key to communicate securely with the certificate's subject. In email encryption, code signing, and e-signature systems, a certificate's subject is typically a person or organization. However, in Transport Layer Security (TLS) a certificate's subject is typically a computer or other device, though TLS certificates may identify organizations or individuals in addition to their core role in identifying devices. TLS, sometimes called by its older name Secure Sockets Layer (SSL), is notable for being a part of HTTPS, a protocol for securely browsing the web.

In cryptography, a certificate authority or certification authority (CA) is an entity that stores, signs, and issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows others to rely upon signatures or on assertions made about the private key that corresponds to the certified public key. A CA acts as a trusted third party—trusted both by the subject (owner) of the certificate and by the party relying upon the certificate. The format of these certificates is specified by the X.509 or EMV standard.

<span class="mw-page-title-main">OpenSSL</span> Open-source implementation of the SSL and TLS protocols

OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping, and identify the party at the other end. It is widely used by Internet servers, including the majority of HTTPS websites.

Datagram Transport Layer Security (DTLS) is a communications protocol providing security to datagram-based applications by allowing them to communicate in a way designed to prevent eavesdropping, tampering, or message forgery. The DTLS protocol is based on the stream-oriented Transport Layer Security (TLS) protocol and is intended to provide similar security guarantees. The DTLS protocol datagram preserves the semantics of the underlying transport—the application does not suffer from the delays associated with stream protocols, but because it uses UDP or SCTP, the application has to deal with packet reordering, loss of datagram and data larger than the size of a datagram network packet. Because DTLS uses UDP or SCTP rather than TCP, it avoids the "TCP meltdown problem", when being used to create a VPN tunnel.

In cryptography, Curve25519 is an elliptic curve used in elliptic-curve cryptography (ECC) offering 128 bits of security and designed for use with the Elliptic-curve Diffie–Hellman (ECDH) key agreement scheme. It is one of the fastest curves in ECC, and is not covered by any known patents. The reference implementation is public domain software.

The Pwnie Awards recognize both excellence and incompetence in the field of information security. Winners are selected by a committee of security industry professionals from nominations collected from the information security community. Nominees are announced yearly at Summercon, and the awards themselves are presented at the Black Hat Security Conference.

Mbed TLS is an implementation of the TLS and SSL protocols and the respective cryptographic algorithms and support code required. It is distributed under the Apache License version 2.0. Stated on the website is that Mbed TLS aims to be "easy to understand, use, integrate and expand".

wolfSSL is a small, portable, embedded SSL/TLS library targeted for use by embedded systems developers. It is an open source implementation of TLS written in the C programming language. It includes SSL/TLS client libraries and an SSL/TLS server implementation as well as support for multiple APIs, including those defined by SSL and TLS. wolfSSL also includes an OpenSSL compatibility interface with the most commonly used OpenSSL functions.

The Transport Layer Security (TLS) protocol provides the ability to secure communications across or inside networks. This comparison of TLS implementations compares several of the most notable libraries. There are several TLS implementations which are free software and open source.

In cryptography, a padding oracle attack is an attack which uses the padding validation of a cryptographic message to decrypt the ciphertext. In cryptography, variable-length plaintext messages often have to be padded (expanded) to be compatible with the underlying cryptographic primitive. The attack relies on having a "padding oracle" who freely responds to queries about whether a message is correctly padded or not. The information could be directly given, or leaked through a side-channel.

<span class="mw-page-title-main">Heartbleed</span> Security bug in OpenSSL

Heartbleed is a security bug in some outdated versions of the OpenSSL cryptography library, which is a widely used implementation of the Transport Layer Security (TLS) protocol. It was introduced into the software in 2012 and publicly disclosed in April 2014. Heartbleed could be exploited regardless of whether the vulnerable OpenSSL instance is running as a TLS server or client. It resulted from improper input validation in the implementation of the TLS heartbeat extension. Thus, the bug's name derived from heartbeat. The vulnerability was classified as a buffer over-read, a situation where more data can be read than should be allowed.

POODLE is a security vulnerability which takes advantage of the fallback to SSL 3.0. If attackers successfully exploit this vulnerability, on average, they only need to make 256 SSL 3.0 requests to reveal one byte of encrypted messages. Bodo Möller, Thai Duong and Krzysztof Kotowicz from the Google Security Team discovered this vulnerability; they disclosed the vulnerability publicly on October 14, 2014. On December 8, 2014, a variation of the POODLE vulnerability that affected TLS was announced.

Logjam is a security vulnerability in systems that use Diffie–Hellman key exchange with the same prime number. It was discovered by a team of computer scientists and publicly reported on May 20, 2015. The discoverers were able to demonstrate their attack on 512-bit DH systems. They estimated that a state-level attacker could do so for 1024-bit systems, then widely used, thereby allowing decryption of a significant fraction of Internet traffic. They recommended upgrading to at least 2048 bits for shared prime systems.

<span class="mw-page-title-main">DROWN attack</span> Security bug

The DROWN attack is a cross-protocol security bug that attacks servers supporting modern SSLv3/TLS protocol suites by using their support for the obsolete, insecure, SSL v2 protocol to leverage an attack on connections using up-to-date protocols that would otherwise be secure. DROWN can affect all types of servers that offer services encrypted with SSLv3/TLS yet still support SSLv2, provided they share the same public key credentials between the two protocols. Additionally, if the same public key certificate is used on a different server that supports SSLv2, the TLS server is also vulnerable due to the SSLv2 server leaking key information that can be used against the TLS server.

<span class="mw-page-title-main">KRACK</span> Attack on the Wi-Fi Protected Access protocol

KRACK is a replay attack on the Wi-Fi Protected Access protocol that secures Wi-Fi connections. It was discovered in 2016 by the Belgian researchers Mathy Vanhoef and Frank Piessens of the University of Leuven. Vanhoef's research group published details of the attack in October 2017. By repeatedly resetting the nonce transmitted in the third step of the WPA2 handshake, an attacker can gradually match encrypted packets seen before and learn the full keychain used to encrypt the traffic.

The ROCA vulnerability is a cryptographic weakness that allows the private key of a key pair to be recovered from the public key in keys generated by devices with the vulnerability. "ROCA" is an acronym for "Return of Coppersmith's attack". The vulnerability has been given the identifier CVE-2017-15361.

Version history for TLS/SSL support in web browsers tracks the implementation of Transport Layer Security protocol versions in major web browsers.

References

  1. ↑ "The Dark Side of Microsoft Windows – Administrative..." BeyondTrust. Retrieved 2023-09-05.
  2. ↑ B. Beurdouche & al (2015-05-18). "A Messy State of the Union: Taming the Composite State Machines of TLS" (PDF). IEEE Security and Privacy 2015.
  3. 1 2 "State Machine AttACKs against TLS (SMACK TLS)". smacktls.com.
  4. ↑ "Vulnerability Summary for CVE-2015-0204". NIST. 20 February 2015.
  5. ↑ Thomas Fox-Brewster (2015-03-03). "What The FREAK? Why Android And iPhone Users Need To Pay Attention To The Latest Hot Vulnerability". Forbes.
  6. ↑ Steven J. Vaughan-Nichols (2015-03-03). "FREAK: Another day, another serious SSL security hole". ZDNet.
  7. ↑ Darren Pauli (6 March 2015). "All Microsoft Windows versions are vulnerable to FREAK". The Register.
  8. ↑ "Microsoft Security Advisory 3046015: Vulnerability in Schannel Could Allow Security Feature Bypass". Microsoft. March 5, 2015.
  9. ↑ "About the security content of iOS 8.2". apple.com. 23 January 2017.
  10. 1 2 3 Craig Timberg (2015-03-03). "'FREAK' flaw undermines security for Apple and Google users, researchers discover". Washington Post.
  11. 1 2 Dennis Fisher (2015-03-03). "New FREAK Attack Threatens Many SSL Clients". Threatpost.
  12. ↑ "FREAK Servers By Country". 2015-03-03.
  13. ↑ Dan Goodin (3 March 2015). ""FREAK" flaw in Android and Apple devices cripples HTTPS crypto protection". Ars Technica.
  14. ↑ "About Security Update 2015-002". Apple. March 9, 2015.
  15. ↑ "About the security content of iOS 8.2". Apple. March 9, 2015.
  16. ↑ "Microsoft Security Bulletin MS15-031 - Important". Microsoft. March 10, 2015.
  17. ↑ "Microsoft Admits Windows Users Are Vulnerable to FREAK Attacks". eweek.com. Archived from the original on April 8, 2015.
  18. ↑ "IEEE Distinguished Paper award for A Messy State of the Union: Taming the Composite State Machines of TLS". 2015-05-18.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.