LOGJAM and FREAK 101

A lot of fuss has been made recently over two new vulnerabilities in TLS/SSL called FREAK and LOGJAM. As a matter of fact, experts are so concerned about the new frequency of TLS/SSL vulnerabilities (Poodle, Logjam, Freak, etc.) that industry standards are changing.  The Payment Card Industry (PCI) oversight group just issued PCI 3.1 out of cycle stating that, “The National Institute of Standards and Technology (NIST) has identified the Secure Socket Layers (SSL) v3.0 protocol as no longer being acceptable for protection of data due to inherent weaknesses within the protocol.” They go on to mandate that, “Companies have until June 30, 2016, to update to a more recent version of TLS. Prior to this date, existing implementations using SSL and or early TLS must have a formal risk mitigation and migration plan in place. Effective immediately, all new implementations must not use SSL or early TLS.” In short, any business software running SSL 2.0 or 3.0 must be reconfigured or upgraded. The new standard appears to be TLS 1.2 and businesses are now left clamoring to upgrade their software standards.

So what is FREAK and LOGJAM?  Well FREAK allows an attacker to sit on the network between a client and a server in a Man-in-The-Middle (MiTM) attack, and the FREAK attack involves trying to trick both ends into accepting what's called an export-grade cipher instead of a proper one.

Clear as mud right? Ok, well let me explain. Export grade ciphers were used in the 1990’s to export encrypted software to countries that were “Not so Friendly” to the USA and her allies.  They were abandoned because computing power and cloud technologies had increased to a point where they were easily crackable. The old TLS/SSL protocols never discontinued their support of the ciphers.  We locked the car, but left the keys in the ignition.

FREAK & LOGJAM both downgrade the ciphers to export-grade and are subject to MiTM.  In Freak, the attacker changes client requests to the server from the normal RSA encryption suite to request the export grade ciphers instead.  LOGJAM is similar, but affects the DIFFIE-HELLMAN (DHE) ciphers, and usually affects TLS protocol services on servers and browsers.
Some advice for LOGJAM is to make sure you TLS libraries are up to date, use 2048 bits ciphers for DHE, and disable support for export grade ciphers on your web or mail servers. For Freak, several client OS and Browser updates/patches have been rolled out to help fix the problem. Remember to update your browsers, clients, and mobile devices.