FREAK lets an attacker between a visitor and a server force deliberately weak old export encryption. Browsers are being patched; servers should switch those settings off. Ask your host whether yours are off, and when.

What was disclosed yesterday

Researchers disclosed a flaw called FREAK yesterday, Tuesday. It lets an attacker who can intercept traffic make some secure connections fall back to a deliberately weak, old form of encryption, then break it.

It needs two things at once: a browser with the flaw, and a server that still accepts the old encryption. Neither alone is enough.

Browser and phone makers are preparing fixes, and some have already said when to expect them. The other half of the fix is a settings change on servers, and for most small businesses that means the host.

Nothing about it requires a new certificate or changes to the website itself. It is a question of server settings, and of updates on the devices people browse with.

Where export encryption came from

In the 1990s, rules on exporting encryption software meant that versions sold abroad had to use deliberately short keys. Software of the time included a weakened "export" mode for that reason.

The rules were relaxed long ago. The export mode stayed in the software, and many servers were never told to stop accepting it.

Keys that short were weak even then. With rented computing today, a determined attacker can break one in a matter of hours.

How the attack works

The attacker has to be in the middle of the connection, for example on the same public Wi-Fi as the visitor, or controlling a router along the way.

When the visitor's browser connects to your site, the attacker quietly asks your server for export encryption instead. A flawed browser accepts the weak key the server sends back without noticing it is not what it asked for.

The attacker breaks the key and can then read or change what passes in both directions, while the padlock still shows in the address bar.

Many servers create their weak export key once and reuse it until they restart, sometimes for weeks. One broken key can open many connections.

What it could expose on a small business site

The third matters most to a shop that takes card numbers on its own pages. A checkout handled entirely on the payment company's pages depends on that company's servers instead of yours.

A shop handling card numbers itself also has the card industry's security standard to meet, and the scans it calls for treat weak encryption settings as a failure.

Why the fix is not yours to make

On most hosting plans the server's encryption settings belong to the host. You could not change them if you wanted to, and you do not need to know how.

The browser side is fixed by browser and phone makers through updates. Your part there is installing them on office computers and phones as soon as they arrive.

The server side protects everyone else. A server that refuses export encryption cannot be tricked into using it, so visitors whose phones never get an update are protected anyway.

The two questions for your host

The first: do the servers that run my website, my email and my control panel still accept export-grade encryption?

The second: if they do, when will it be switched off, and will you tell me when it is done?

A good host will answer both in a line or two. A reply that does not seem to understand the question tells you something as well.

Ask the same two questions of anyone else who runs a secure page for you, such as an online booking system or a shop platform. Keep the answers, with their dates.

A worked example

A coin dealer with a small shop in an older commercial block buys and sells Canadian and world coins, banknotes and bullion, and sells graded coins through an online shop on its own website.

Customers log in to track orders and keep want lists, and they type their card details on the shop's own checkout page.

Yesterday the owner did not know what export encryption was, and did not need to. He emailed the host the two questions and ran his address through a free server test, which listed export settings as accepted.

The host replied that afternoon. The settings had been left on for very old browsers, and would be switched off on that server overnight.

This morning the test showed them gone. The owner set the shop's two computers and its phone to take browser updates as they arrive, and filed the host's reply with the shop's card security records.

Checking it yourself

Free online tests will grade a server's encryption settings from its address alone. Run one on your site's address now, and again after the host says the change is made.

The results are technical, but the line that matters is plain: whether export cipher suites, the old settings, are listed as supported.

The same test flags other old settings, such as SSL 3.0, the protocol found broken last autumn. If your server still allows it, add it to the conversation with the host.

The counter-case

A site with no secure pages at all, no logins, no forms on HTTPS and no shop, has nothing for FREAK to weaken, though the host's mail and control panel settings still matter.

The attack also needs someone in the middle of the connection, which is far easier on shared Wi-Fi than on a home or office line. It is targeted, not something that reaches every visitor automatically.

None of that is a reason to wait. Ask your host the two questions this week, and install browser updates as they arrive.

This week

  1. Ask your host whether export encryption is accepted.
  2. Ask when it will be switched off.
  3. Ask your shop or booking provider the same.
  4. Test your site's address once the host replies.
  5. Install browser and phone updates as they arrive.
  6. File each answer with its date.
  7. Ask what other old settings are still on.

Step four is the one that turns an answer into a fact. A host's reply that the change is done is reassuring; a test of your own address showing no export settings is proof.

Software that gets no fixes at all is the same problem on a larger scale, covered in a site still running Joomla 1.5.

Frequently asked questions

What is the FREAK vulnerability?

A flaw disclosed on March 3 that lets an attacker in the middle of a connection force deliberately weak old export encryption, then break it, when browser and server both allow it.

Who has to fix it?

Browser and phone makers are preparing updates for the browser side. On most hosting plans the server side belongs to the host, which should switch the old settings off.

What should I ask my host?

Whether the servers running your website, email and control panel still accept export-grade encryption, and if so, when it will be switched off and whether they will confirm it.

Can I check my own server?

Yes. Free online tests grade a server's encryption settings from its address. Run one now and again after the host replies, and look for export settings listed as supported.

Does it affect sites without secure pages?

A site with no logins, no secure forms and no shop has nothing for FREAK to weaken, though the host's mail and control panel settings still matter.

What should I do on office computers?

Install browser and phone updates as soon as they arrive. A server that refuses export encryption also protects visitors whose devices never get the update.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure what your host has switched on?

Tell us your domain. We will look at its encryption settings and draft the questions for your host.

Start a Conversation