Apple, Google device users vulnerable to hacking over 'zombie' security bug

Aqua · 2015-03-06T06:06:53+00:00

Apple is preparing a security patch that will be in place next week for its computers and mobile devices; while Google's Chrome browser is not vulnerable to the bug, but the browser that comes built into most Android devices is. Photos: Bloomberg, AF Technology companies are scrambling to fix a major security flaw that for more than a decade left users of Apple and Google devices vulnerable to hacking when they visited millions of supposedly secure websites, including Whitehouse.gov, NSA.gov and FBI.gov. The flaw resulted from a former US government policy that forbade the export of strong encryption and required that weaker "export-grade" products be shipped to customers in other countries, say researchers who discovered the problem. Those restrictions were lifted in the late 1990s, but the weaker encryption was baked into software that proliferated around the world and made its way back into the United States - apparently unnoticed until this year. Researchers discovered they could force browsers to use the weaker encryption and then crack it over the course of just a few hours. Once cracked, hackers could steal passwords and other personal information, and potentially launch a broader attack on the websites themselves by taking over elements on a page, such as a Facebook "Like" button. The existence of the problem with export-grade encryption amazed researchers, who have dubbed the flaw "Freak" ,for Factoring attack on RSA-EXPORT Keys. The encryption had 512 bits, the maximum allowed under US restrictions designed to limit trade in military technologies in the 1990s. But 512-bit cryptography has been considered unacceptably weak for more than a decade. Even experts thought it had disappeared. "We thought, of course, people stopped using it," said Karthikeyan Bhargavan, a researcher at the French computer science lab INRIA whose team initially found the problem during testing of encryption systems. Nadia Heninger, a University of Pennsylvania cryptographer, added: "This is basically a zombie from the '90s." For vulnerable sites, Heninger found that she could crack the export-grade encryption key in about seven hours This would allow hackers to conduct what experts call a "man-in-the-middle" attack to make seemingly encrypted traffic easy to read. Such attacks can be launched by anyone who has access to internet traffic, including governments, internet providers and coffee shops or airports that offer wifi hotspots. More than a third of encrypted websites - including those bearing the "padlock" icon that signifies a connection securedby SSL technology - proved vulnerable to attack in recent tests conducted by University of Michigan computer science researchers Alex Halderman and Zakir Durumeric. Of the 14 million websites worldwide that offer encryption, more than five million remained vulnerable as of Tuesday, Halderman said. There is no way to know how widely the Freak flaw has been used to hack internet users, though "man-in-the-middle attacks" are popular among governments conducting online surveillance, particularly in their own countries, such as Iran and China. Travellers are also vulnerable whenever they log on to the internet from a hotel, for example. In recent days, FBI.gov and Whitehouse.gov have been fixed, although NSA.gov remained vulnerable, Green said. Apple is preparing a security patch that will be in place next week for its computers and mobile devices. Google's Chrome browser is not vulnerable to the bug, but the browser that comes built into most Android devices is. Connections to Google's search website are not affected by the flaw. The company said it had developed a patch for the Android operating system's browser and provided it to companies that make most Android devices. It will be up to those companies to deploy it. Source

Thread starter Aqua
Start date Mar 6, 2015

Aqua

JamiiForums uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.

Accept Learn more…

Back

Top Bottom

Forums

New posts

Apple, Google device users vulnerable to hacking over 'zombie' security bug

Aqua

JF-Expert Member

Our Community

Regional Communities