Computers running all supported versions of Microsoft Windows are vulnerable to "FREAK," a bug disclosed Monday that for more than a decade has made it possible for attackers to
decrypt HTTPS-protected traffic passing between vulnerable end-users and millions of websites.
Microsoft confirmed the vulnerability in an
advisory published Thursday.
A vulnerability-scanning service at
FREAKAttack.com, a site that offers information about the bug, confirmed the advisory, showing that the latest version of IE 11 running on a fully patched Windows 7 machine was susceptible. Previously, it was believed that the Windows system was immune to the attacks.
FREAK attacks—short for Factoring attack on RSA-EXPORT Keys—are possible when an end-user with a vulnerable device connects to a vulnerable HTTPS-protected website. Vulnerable sites are those configured to use a weak cipher that many presumed had been retired long ago. In analyses immediately following Monday's disclosure of FREAK, it was believed Android devices, iPhones and Macs from Apple, and smartphones from Blackberry were susceptible. The addition of Windows dramatically increases the number of users known to be vulnerable.
