FREAK Attack Threatens SSL Clients

Posted by Soulskill on Tuesday March 3, 2015 @09:29AM from the another-day-another-vuln dept.

msm1267 writes: For the nth time in the last couple of years, security experts are warning about a new Internet-scale vulnerability, this time in some popular SSL clients. The flaw allows an attacker to force clients to downgrade to weakened ciphers and break their supposedly encrypted communications through a man-in-the-middle attack. Researchers recently discovered that some SSL clients, including OpenSSL, will accept weak RSA keys–known as export-grade keys–without asking for those keys. Export-grade refers to 512-bit RSA keys, the key strength that was approved by the United States government for export overseas. This was an artifact from decades ago and it was thought that most servers and clients had long ago abandoned such weak ciphers. The vulnerability affects a variety of clients, most notably Apple's Safari browser.

1 of 89 comments (clear)

Min score:

Reason:

Sort:

Re:FREAK by TechyImmigrant · 2015-03-03 10:55 · Score: 2, Funny

Factoring Attack on RSA-EXPORT Keys
Why do people go to the trouble of making an acronym if they're going to screw it up anyway?
Factoring Attack on Rsa-exporT keys?

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.