UPDATED throughout 12:45 pm Thursday (March 5) with new browser vulnerability results.
The FREAK flaw in Web encryption disclosed Monday (March 2) is serious, yet affects only some browsers on some platforms. Here's how to tell whether you're affected, and what you can do about it.
University of Michigan researchers have put up a website, https://freakattack.com/, that tells you whether a browser is vulnerable and offers additional information about the attack.
FREAK, an acronym for Factoring attack on RSA-EXPORT Keys, undermines the security of encrypted Web connections, designated by the "https" prefix or a padlock icon in a website address. (Unencrypted "http" connections are not affected, but were never secure to begin with.) An attacker could use the flaw to intercept an online banking or retail session and gain access to the victim's account or credit cards.
Google is patching Chrome on OS X against the FREAK flaw today (March 4), and Apple promises a fix for Safari on iOS and OS X for next week.
The following Web browsers are vulnerable to FREAK, according to our tests using freakattack.com:
- Safari and Opera on OS X (older versions of Chrome are vulnerable as well)
- Chrome, Dolphin, Opera and (reportedly) the stock browser on Android
- Safari, Dolphin and Opera Mini on iOS
- Internet Explorer on Windows (added Thursday after the Freak Attack website adjusted its methods)
- Opera on Linux (per the Freak Attack website)
- BlackBerry browser (per the Freak Attack website)
The following Web browsers are safe from FREAK, according to our tests:
- Chrome, Firefox, Internet Explorer and Opera on Windows
- Firefox on OS X (Chrome 41, pushed out Wednesday, is also immune)
- Firefox on Android
- Chrome on iOS
For now, assume that all browsers in Windows are immune. We've seen reports that all browsers in desktop Linux may also be immune, but we haven't been able to confirm that yet.
What to do about FREAK
Here's what you need to do now to protect yourself from FREAK attacks:
Windows:No worries — you're safe. Use Chrome, Firefox or Opera.
Mac OS X: Use Firefox, or force an update to Chrome 41 by going to "About Google Chrome" under the Chrome menu in the top left of the screen.
iOS: Until Apple pushes out a patch, use the Chrome browser.
Android: Use the Firefox browser. Google has a patch ready for Chrome, but it's up to device makers and wireless carriers to push it out to most Android users.
Linux:You're probably safe. Use a browser other than Opera.
- Can You Hide Anything from the NSA?
- Best Antivirus Software for Mac
- How to Keep Your Smartphone or Tablet Secure