U.S Government Policy leaves Android and Apple users Vulnerable
“We thought of course people stopped using it,” said Karthikeyan Bhargavan, a researcher at the French computer science lab INRIA whose team initially found the problem during testing of encryption systems.
Nadia Heninger, a University of Pennsylvania cryptographer, said, “This is basically a zombie from the ’90s… I don’t think anybody really realized anybody was still supporting these export suites.
The security exploit called FREAK, allowed researches to sniff traffic going to and from encrypted websites included some government websites. It allows hackers to force a victims connection to use old encryption ciphers, which are still used in Android and Apple’s Safari.
To view the exploitable sites, visit here
Among the various state machine problems we found, one is particularly interesting because it leads to a server impersonation exploits against several mainstream browsers (including Safari and OpenSSL-based browsers on Android)
As the name implies, this class of algorithms have been introduced under the pressure of US governments agencies to ensure that the NSA would be able to decrypt all foreign encrypted communication, while stronger algorithms were be banned from export (as they were classified as weapons of war)
If a server is willing to negotiate an export ciphersuite, a man-in-the-middle may trick a browser (which normally doesn’t allow it) to use a weak export key. By design, export RSA moduli must be less than 512 bits long; hence, they can be factored in less than 12 hours for $50 on Amazon EC2
Ironically, many US government agencies (including the NSA and FBI), as well as a number of popular websites (IBM, or Symantec) enable export ciphersuites on their server – by factoring ther 512-bit RSA modulus, we can impersonate them to vulnerable clients
Apple has responded by saying that a fix will be released by next week.
