Windows users still affected by old SSL backdoor

Windows users are nevertheless susceptible to a vulnerability in SSL that can force weak encryption. Initially, Windows users were thought to be safe from the problem, unlike OS X, iOS, and Android users.

Microsoft has now confirmed that Windows users are indeed vulnerable to the so-called Freak attack. All supported Windows versions are affected; older versions such as Windows XP presumably also, but they will not be provided with an update. It is not yet clear when an update will be released for the supported Windows versions. Incidentally, only the desktop versions of Windows are affected, not the server versions.

Users can avoid being affected by using a browser other than Internet Explorer. Chrome and Firefox use their own SSL library, instead of the Windows SChannel library. Therefore they are not susceptible.

The Freak attack came to light on Wednesday and allows an attacker to force an RSA key of only 512bit on a secure connection. An old US government backdoor is used for this purpose. In the 1990s, the US government banned companies from offering strong encryption outside the United States. As a result, RSA encryption keys abroad were not allowed to be more than 512bit, for example, so that the American secret services could crack the communication relatively easily.

The vulnerability appears to have been present for years, but until now it has been underexposed. When creating an ssl connection, the vulnerable browsers do not actively request this lower level of security, but a server can request it. An attacker could pose as a server and force the lower level of security. In that case, the key of only 512bit will be accepted without warning.

In addition to Windows, Chrome on Android has been affected, as well as iOS and Safari on OS X. BlackBerry 10 is also said to be vulnerable, as are some versions of Internet Explorer on Windows Phone. The desktop version of Chrome is not vulnerable and neither is Firefox.