Advertisement

We need your help now

Support from readers like you keeps The Journal open.

You are visiting us because we have something you value. Independent, unbiased news that tells the truth. Advertising revenue goes some way to support our mission, but this year it has not been enough.

If you've seen value in our reporting, please contribute what you can, so we can continue to produce accurate and meaningful journalism. For everyone who needs it.

mouse via Shutterstock
freak out

Every version of Windows is at risk from this 1990s bug

A patch is on the way.

WINDOWS USERS ARE susceptible to a serious vulnerability affecting millions of Android and iPhone users.

It’s called “FREAK”, and puts users at risk of their confidential details stolen by hackers.

It is a remnant of the debates over cryptography in the nineties. The US government at one point placed limits on the strength of encryption in software that could be exported from from America.

This meant authorities could, if need be, intercept communications of products that has this weaker encryption strength. These limits were later relaxed and encryption became considerably stronger. But the early restrictions had a nasty effect.

“The weaker encryption got baked into widely used software that proliferated around the world and back into the United States, apparently unnoticed until this year,” the Washington Post explains.

This means that many websites and browsers are still programmed to provide weak keys for security when requested, even though they can now be cracked in a matter of hours.

“Man in the middle”

As a result, a hacker could go to an affected website, obtain its weak key, crack it, then be able to impersonate that website and intercept traffic to the site on the same network as them. It’s what’s often called a “man in the middle” attack. On your home WiFi you’re probably safe, but you could be targeted whenever you log on to a public network, like a a coffee shop, or a hotel, or an airport.

Ars Technica reports that people hadn’t previously thought Windows users were affected — but that’s not the case. Microsoft has since confirmed that its users are vulnerable, writing that it ”is aware of a security feature bypass vulnerability…. that affects all supported releases of Microsoft Windows”. Like Google and Apple, the company is now working on a fix.

The list of websites affected by FREAK is extensive. Banks like American Express and Santander are vulnerable, along with other major websites like Groupon and shopping site J-Crew. At one point, the websites of the White House, the NSA, and the FBI were all affected, according to the Washington Post, although they’ve since implemented fixes. According to one site dedicated to tracking FREAK, 9.5% of the Alexa Top 1 Million websites are affected (down from 12.2% as people begin to patch the issue).

What this means in real terms is that when you’re shopping online, or checking your bank statement, or logging onto one of your favourite sites, hackers may be harvesting your sensitive personal information.

There’s no confirmed uses of FREAK to harvest confidential data — but the vulnerability has existed for decades, so it’s not unthinkable to suggest it may have been used.

- Rob Price

Read: Google, Microsoft and co join forces to prevent the next Heartbleed from happening >

Readers like you are keeping these stories free for everyone...
A mix of advertising and supporting contributions helps keep paywalls away from valuable information like this article. Over 5,000 readers like you have already stepped up and support us with a monthly payment or a once-off donation.

Published with permission from
Business Insider
Your Voice
Readers Comments
8
    Submit a report
    Please help us understand how this comment violates our community guidelines.
    Thank you for the feedback
    Your feedback has been sent to our team for review.