The FREAK Flaw: How to Protect Yourself

How-to
By Paul Wagenseil
published

The FREAK flaw is a serious threat, but not all Web browsers are vulnerable. Here's what is affected, and what to do about it.

Credit: Atlantic Records

(Image credit: Atlantic Records)

UPDATED throughout 12:45 pm Thursday (March 5) with new browser vulnerability results.

The FREAK flaw in Web encryption disclosed Monday (March 2) is serious, yet affects only some browsers on some platforms. Here's how to tell whether you're affected, and what you can do about it.

University of Michigan researchers have put up a website, https://freakattack.com/, that tells you whether a browser is vulnerable and offers additional information about the attack.

MORE: FREAK Flaw Threatens Android, iOS Devices Worldwide

FREAK, an acronym for Factoring attack on RSA-EXPORT Keys, undermines the security of encrypted Web connections, designated by the "https" prefix or a padlock icon in a website address. (Unencrypted "http" connections are not affected, but were never secure to begin with.) An attacker could use the flaw to intercept an online banking or retail session and gain access to the victim's account or credit cards.

Google is patching Chrome on OS X against the FREAK flaw today (March 4), and Apple promises a fix for Safari on iOS and OS X for next week.

Vulnerable browsers

The following Web browsers are vulnerable to FREAK, according to our tests using freakattack.com:

  • Safari and Opera on OS X (older versions of Chrome are vulnerable as well)
  • Chrome, Dolphin, Opera and (reportedly) the stock browser on Android
  • Safari, Dolphin and Opera Mini on iOS
  • Internet Explorer on Windows (added Thursday after the Freak Attack website adjusted its methods)
  • Opera on Linux (per the Freak Attack website)
  • BlackBerry browser (per the Freak Attack website)

Safe browsers

The following Web browsers are safe from FREAK, according to our tests:

  • Chrome, Firefox, Internet Explorer and Opera on Windows
  • Firefox on OS X (Chrome 41, pushed out Wednesday, is also immune)
  • Firefox on Android
  • Chrome on iOS

For now, assume that all browsers in Windows are immune. We've seen reports that all browsers in desktop Linux may also be immune, but we haven't been able to confirm that yet.

What to do about FREAK

Here's what you need to do now to protect yourself from FREAK attacks:

Windows:No worries — you're safe. Use Chrome, Firefox or Opera.

Mac OS X: Use Firefox, or force an update to Chrome 41 by going to "About Google Chrome" under the Chrome menu in the top left of the screen.

iOS: Until Apple pushes out a patch, use the Chrome browser.

Android: Use the Firefox browser. Google has a patch ready for Chrome, but it's up to device makers and wireless carriers to push it out to most Android users.

Linux:You're probably safe. Use a browser other than Opera.

Paul Wagenseil is a senior editor at Tom's Guide focused on security and gaming. Follow him at @snd_wagenseil. Follow Tom's Guide at @tomsguide, on Facebook and on Google+.

Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.