Following Microsoft’s release, Apple has finally issued security updates that among other things, addresses the issue of FREAK secure sockets layer/transport layer protocol bug. IT support services sources reveal that the fix is available for three versions of OS X, which includes Mountain Lion 10.8.5, Mavericks 10.9.5, up to the latest one which is Yosemite 10.10.2.
In a statement released by Apple, it said they addressed the FREAK issue – a bug that allows attackers to breach encryption by forcing servers to downgrade to weaker cipher keys – by taking away support for ephemeral RSA keys as FREAK only affected connections to servers that support export-strength RSA cipher suites.
FREAK originated around the late 1990s when a now-defunct US government policy banned the export of strong encryption thus requiring the need for weaker export-grade products for shipping to customers outside of the US. Unfortunately, long after the policy was terminated, these weaker keys were continued to be used by various software companies. The oversight was finally noticed this year by the miTLS team, a group of cryptographers at INRIA, Microsoft Research and IMDEA.
How do you know if you’re vulnerable to a FREAK attack? If you use a buggy web browser to connect, over an insecure network to an HTTPS website that allows export cipher suites, then you’re vulnerable. However, if you use Chrome 41 or Firefox to connect to a site that only offers strong ciphers, then you’re probably not affected in any way.
Here’s how to test it: On your browser, try and access https://www.smacktls.com/freak . If you succeed, then you are vulnerable.
Additionally, Apple released several other security updates that according to IT support services insiders, included fixes for three flaws in low-level OS components which could be utilized in executing arbitrary code with system privileges. Apple also patched the iCloud Keychain authentication utility against attackers who could use buffer overflows in the tool to run arbitrary code on potential victims’ systems should they are able to obtain a privileged man in the middle network position.
Another flaw, this time discovered by the Chinese TalG team which makes jailbreaks for Apple’s iOS mobile operating system, which allows users to obtain administrator rights or root privileges on their device to be able to install software from other sources outside that of the Apple App Store. This flaw – a memory address space layout randomization bug which leaked the location of kernel addresses and heap permutation values – also has been fixed.
