Outdated US Encryption Creates Logjam for IT Departments

A few months ago, French researchers disclosed a flaw that could conduct man-in-the-middle attacks at public WiFi hotspots to intercept traffic that the user believes is secure. However, now an international group of researchers have uncovered another flaw that works similarly to FREAK, they are calling Logjam.

This one again may allow attackers to do a man-in-the-middle attack by intercepting traffic and redirecting users to another site. This one is also related to encryption standards that were mandated by the US government during 90s for sites accessed by international entities. The government wanted the encryption to be breakable for "national security" reasons of the time.

However, unlike FREAK, Logjam may trick a server into "thinking" it is using stronger encryption than it is. This makes it more dangerous. Also, unlike FREAK, Logjam can also be exploited using Safari, Chrome, and Firefox as well as the mobile Android browser. Although all the developers of those browsers have been notified, as of June first, some were still vulnerable.

Even though there are reports that this has not been exploited too much, it's wise to address the issue, if you are responsible for servers at your place of business. It's also important to always keep them patched and updated.

There are many reasons for this. 

Logjam can be used for practical passive decryption, according to Kenneth White of the Open Crypto Audit Project. Even some 1024-bit keys could be cracked, so researchers recommend moving to stronger key exchange methods.

• It's likely more flaws will be discovered. This is because a team of researchers is actively looking for them.
• Some websites may not work because the browsers will not accept connections for sites with encryption less than 1024 bits. The EXPORT encryption that is still used only allows 512 bits.

On the upside, both the client and the server need to be vulnerable for this particular attack to succeed. However, this doesn't mean it's wise to wait to correct any issues.

Browsers can be verified for vulnerability to this, but as of last week only Microsoft's Internet Explorer 11 was patched. The site to check is weakhd.org and if your browser can be tricked, it'll give a clear "Warning!" message. As of June 1, Chrome and Safari are still unpatched at a minimum. Just another reminder to keep your software updated with all the latest patches and to consider moving to the current version of IE. The longer an organization stays with very old versions of IE, the more vulnerable they become to attack.