Earlier this week security researchers disclosed a SSL/TLS vulnerability dubbed the FREAK – “Factoring attack on RSA Export Keys” – attack. This flaw enables an attacker to conduct a man-in-the-middle attack between vulnerable clients and servers, allowing him or her to eavesdrop on and/or inject malicious payloads into supposedly secure communications.

What Is FREAK?

Back in the 1990s, U.S. government policy forbade the export of strong encryption and required that weaker “export-grade” products be shipped to non-U.S. customers. Although this restriction was lifted in the late 1990s, support for weaker encryption keys is still baked into many software products, and it has been shown that these weaker keys can be cracked in a matter of hours with the technology available today.

The combination of the ubiquity of weak keys and the behavior of many clients and servers to accept weak keys makes it possible for an attacker to impersonate a trusted web site or service. The attacker can then take control of all information passing back and forth between the user and the real destination, with neither realizing that it is happening. Scary, right?

Mitigating Against FREAK

First of all, you need to find out if your site is vulnerable. You can check whether or not a site is affected by using the SSL Freak Check site.

If your site is among the more than 5 million sites that are susceptible to this vulnerability, the best way to protect against FREAK is to disable support for any export-grade cipher suites in software that uses SSL/TLS. This includes web browsers, web servers, and any application or utility that calls a remote service over SSL/TLS. For web servers, this means explicitly forbidding the use of RSA export cipher suites in the web server configuration. Mozilla has published some guidelines as well as a SSL Configuration Generator that you can use to generate safe configurations for several common web servers.

Spark::red also recommends that administrators check their site’s overall SSL/TLS posture periodically using Qualys SSL Labs’ SSL Server Test.

Most of Spark::red’s clients are behind a Content Delivery Network (CDN) such as CloudFlare or Akamai. CloudFlare is already set up to disallow weak cipher suites. Akamai is working to address the issue.

Many of Spark::red’s clients are already secured at origin as well. We are working with those who aren’t to move away from allowing export-grade communications between their CDN and origin in order to provide an added layer of protection.

Note that hardening your list of supported cipher suites does not require new SSL certificates to be created!

At Spark::red, we take our clients’ information security seriously. Need help with securing your Oracle Commerce site? Contact us with any questions.