Microsoft Security Advisory 3046015 (FREAK)

Microsoft released Security Advisory 3046015 which relates to the SSL/TLS issue referred being referred to as “FREAK” (Factoring attack on RSA-EXPORT Keys).

Most of the publicity surrounding FREAK has been addressing the vulnerability in the Safari, Chrome and Android browsers with OS X, iOS and Android.  However, the flaw also affects many popular websites.  As described in the Security Advisory:

"The vulnerability could allow a man-in-the-middle (MiTM) attacker to force the downgrading of the cipher used in an SSL/TLS connection on a Windows client system to weaker individual ciphers that are disabled but part of a cipher suite that is enabled."

The problem is that it isn't only the browser that is vulnerable but websites as well.  Are you or the sites you frequent vulnerable?  To find out, do the following:

• Test your browser for the FREAK Vulnerability at https://freakattack.com/.  
• A list of websites known to be vulnerable to FREAK is at https://freakattack.com/vulnerable.txt.  You can also check websites you frequent at SSL Server Test, although if vulnerable, it is up to the website to update their server. 

To learn more about FREAK, see Time to FREAK out? How to tell if you're vulnerable | Computerworld by Gregg Keizer.

References:

• CVE Reference:  CVE-2015-1637
• MSRC: Security Advisory 3046015 released
• Tech Net Advisory: Microsoft Security Advisory 3046015 Vulnerability in Schannel Could Allow Security Feature Bypass
• Tracking the FREAK Attack 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...