|
News of the vulnerability surfaced on Tuesday
when a group of nine security experts disclosed that ubiquitous
Internet encryption technology could make devices running Apple
Inc's iOS and Mac operating systems, along with Google Inc's
Android browser vulnerable to cyber attacks.
Microsoft released a security advisory on Thursday warning
customers that their PCs were also vulnerable to the "Freak"
vulnerability.
The weakness could allow attacks on PCs that connect with Web
servers configured to use encryption technology intentionally
weakened to comply with U.S. government regulations banning
exports of the strongest encryption.
If hackers are successful, they could spy on communications as
well as infect PCs with malicious software, the researchers who
uncovered the threat said on Tuesday.
The Washington Post on Tuesday reported that whitehouse.gov and
fbi.gov were among the sites vulnerable to these attacks, but
that the government had secured them. (wapo.st/18KaxIA)
Security experts said the vulnerability was relatively difficult
to exploit because hackers would need to use hours of computer
time to crack the encryption before launching an attack.
"I don't think this is a terribly big issue, but only because
you have to have many ducks in a row," said Ivan Ristic,
director of engineering for cybersecurity firm Qualys Inc.
That includes finding a vulnerable web server, breaking the key,
finding a vulnerable PC or mobile device, then gaining access to
that device.
Microsoft advised system administrators to employ a workaround
to disable settings on Windows servers that allow use of the
weaker encryption. It said it was investigating the threat and
had not yet developed a security update that would automatically
protect Windows PC users from the threat.
Apple said it had developed a software update to address the
vulnerability, which would be pushed out to customers next week.
Google said it had also developed a patch, which it provided to
partners that make and distribute Android devices.
"Freak" stands for Factoring RSA-EXPORT Keys.
(Reporting by Jim Finkle; Editing by Jonathan Oatis and Richard
Chang)
[© 2015 Thomson Reuters. All rights
reserved.] Copyright 2015 Reuters. All rights reserved. This material may not be published,
broadcast, rewritten or redistributed.
 |
|
