# MA-457.032015: MyCERT Alert - SSL/TLS Vulnerability Allow Remote SSL Servers to Conduct RSA to EXPORT_RSA Downgrade Attacks

**Date:** 06 Mar 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-457.032015  
**Advisory ID:** MA-457.032015

---

#### **1.0   Introduction**
MyCERT have received information from valid sources regarding SSL/TLS vulnerability that allows attackers to force many devices, including iOS and Android devices to downgrade their encrypted connections to use weaker cryptographic keys. The vulnerability is known as FREAK, short for Factoring attack on  RSA-EXPORT Keys. The security exploit was found by researcher from IMDEA, INRIA and Microsoft Research. The FREAK attack has the CVE identifier CVE-2015-0204.
**2.0   Impact**
The vulnerability allows attackers to intercept HTTPS connections between vulnerable clients and servers and force them to use ‘export-grade’ cryptography, which can then be decrypted or altered. This is affected on any website that allow the uses of 512-bit export-grade keys.
**3.0   System Affected**
At present, vulnerable software and devices included:
Client Side:
- Safari on OS X (older versions of Chrome are vulnerable as well)
- Safari, Dolphin, Opera and default Android browser
- Opera Mini on iOS
Server-side:
- OpenSSL 1.01k and older
**4.0   Recommendation**
As of now, Apple and Google are preparing patches.
For End user:
- For Mac OS X user, use Firefox or force an update to Chrome version 41.
- For iOS as of now, patches is on going to be release by Apple until they announce.
- For Android user, they can use Firefox browser. Google has a patch ready and depend on device manufacturer to release an update to all Android users.
For Website Administrator:
- Upgrade affected servers to the latest version of OpenSSL.
- Check if their servers are affected by running the following command:
openssl s\_client -connect :443 -cipher EXPORT CONNECTED
If an "alert handshake failure" message is returned, the server is not affected.
Or they can check online if their server is vulnerable:
<https://tools.keycdn.com/freak>
Generally, MyCERT advises users and Administrators of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#31524853544308080871524853544342545244435845481f5c48) or [[email protected]](/cdn-cgi/l/email-protection#e08d9983859294a08d9983859294ce8f9287ce8d99) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT (EMAIL) (COMPLAINT) to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0   Reference**
1. <https://freakattack.com/>
2. <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204>
3. <https://www.smacktls.com/>
4. <http://www.tomsguide.com/us/freak-flaw-how-to-protect,news-20580.html>
5. <https://www.singcert.org.sg/alerts/21-latest/646-singcert-freak-attack>