Researchers disclosed a new SSL/TLS vulnerability — the FREAK attack. The vulnerability allows attackers to intercept HTTPS connections between vulnerable clients and servers and force them to use ‘export-grade’ cryptography, which can then be decrypted or altered.
A connection is vulnerable if the server accepts RSA_EXPORT cipher suites and the client either offers an RSA_EXPORT suite or is using a version of OpenSSL that is vulnerable to CVE-2015-0204. Vulnerable clients include many Google and Apple devices (which use unpatched OpenSSL), a large number of embedded systems, and many other software products that use TLS behind the scenes without disabling the vulnerable cryptographic suites.
Top 20 vulnerable sites based on Alexa rank:
Test your browser (client) for SSL FREAK vulnerability
How to check your server for SSL FREAK vulnerability
Open a terminal and type:
openssl s_client -connect www.google.com:443 -cipher EXPORT
Replace www.google.com with your hostname.
140014904252064:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:770:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 7 bytes and written 111 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify error:num=20:unable to get local issuer certificate
SSL handshake has read 5417 bytes and written 245 bytes
New, TLSv1/SSLv3, Cipher is EXP-DES-CBC-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported