Microsoft Windows vulnerable to 'FREAK' encryption flaw too

[Borg 386]

Computers running all supported releases of Microsoft Windows are vulnerable to "FREAK," a decade-old encryption flaw that leaves device users vulnerable to having their electronic communications intercepted when visiting any of hundreds of thousands of websites, including Whitehouse.gov, NSA.gov and FBI.gov.

The flaw was previously thought to be limited to Apple's Safari and Google's Android browsers. But Microsoft warned that the encryption protocols used in Windows -- Secure Sockets Layer and its successor Transport Layer Security -- were also vulnerable to the flaw.

"Our investigation has verified that the vulnerability could allow an attacker to force the downgrading of the cipher suites used in an SSL/TLS connection on a Windows client system," Microsoft said in its advisory. "The vulnerability facilitates exploitation of the publicly disclosed FREAK technique, which is an industrywide issue that is not specific to Windows operating systems."

Microsoft said it will likely address the flaw in its regularly scheduled Patch Tuesday update or with an out-of-cycle patch. In the meantime, Microsoft suggested disabling the RSA export ciphers.

http://www.cnet.com/news/windows-vu...=nl.e703&s_cid=e703&ttag=e703&ftag=CAD090e536

 

[Seffrid]

Covered by the BBC too:-

BBC News - Millions at risk from 'Freak' encryption bug

On the other hand, it's not all bad news:-

BBC News - Dozens arrested in cybercrime 'strike week'

 

[Callender]

Checked and seems okay

Checked here:

https://freakattack.com/clienttest.html

Cyberfox, Airfox & Opera browsers all okay. Will check my other installed browsers too. Interesting that Cybefox shows the least number of cipher suites.

​

​

​

 

[Seffrid]

I did a test with Chrome and that passed ok.

IE9 failed.

 

[Urthboundmisfit]

FFox 36.0.1 OK

IE11 Failed.

 

[Callender]

Test IE 11

FFox 36.0.1 OK

IE11 Failed.

Maybe see what shows up here:

https://www.ssllabs.com/ssltest/viewMyClient.html#1425682751090&frame_loaded

Which cipher suites are shown as a problem - if any?

 

[Callender]

For IE users: Check if Windows is affected by the Freak Attack vulnerability - gHacks Tech News

Looks like it's time to switch to another browser until it's patced if you have any concerns/

 

[ThrashZone]

To pass the test in ie,
Simply go to Internet options/ Advanced/ Uncheck All ssl's and tsl's and only leave checked (tsl 1.2)

 

[M1GU31]

I passed the test with default settings on IE but it's on win 10. Cyberfox passes too which is what I use.

 

[ThrashZone]

Server 2003 is unaffected

 

[Callender]

Edit: Article state "There is no workaround for systems that don't support the Group Policy Editor" so for my machine with Windows 7 Home Premium they're saying that you can't change the preferred order of cipher suites.

That's funny because here's what I see:

Test page for preferred order and available cipher suites:



That seems to be an exact match for what I specified in the registry: No RC4 ciphers.

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA

 

[ThrashZone]

Correction server 2003 very effected

 

[ThrashZone]

Using only tls 1.2 will pass the test
Unfortunately some sites you'll get this page can't be displayed like on TenForums

 

[Anak]

FFox 36.0.1 OK

IE11 Failed.

Maybe see what shows up here:

https://www.ssllabs.com/ssltest/viewMyClient.html#1425682751090&frame_loaded

Which cipher suites are shown as a problem - if any?

Check the last two at the bottom:

To pass the test in ie,
Simply go to Internet options/ Advanced/ Uncheck All ssl's and tsl's and only leave checked (tsl 1.2)

I can confirm this works with IE10 at: https://freakattack.com/clienttest.html but, at ssllabs it shows the client (IE10) as not vulnerable to freak although, the same last two ciphers as shown above are weak, the freak site doesn't.

 

[ThrashZone]

Yep I was just toying with the settings to see if I could pass the test
Allot of https sites could not be displayed just using tls 2.1

Home premium people are screwed until Microsoft feels it necessary to fix the issue which they hate 7'ers anyway so it is time to dump ie and turn it off in windows features

 

[ThrashZone]

Looks like the updates today have fixed the issue.