The FREAK vulnerability has left many computer users of all types concerned about their security as it leaves many types of systems ready to be attacked. That being said, to this point computer and Internet security experts have warned that while there haven’t been any attacks using this exploitation to this point, it could easily happen. Originally, the news suggested that only Apple and Google users – those running Chrome or Firefox – would be susceptible to this type of exploitation.
The exploitation ultimately allows for a man-in-the-middle attack that allow secure connections to be compromised when visiting various websites. Interestingly, this is something that even though hasn’t been utilized or put into action – is an incredibly old vulnerability. In fact, experts say that it’s something that is as old as the Internet itself in some ways. Dating back to the 90’s this type of exploitation, or path to exploitation existed, which means users information could have been compromised to this type of attack years ago, and it might have taken this long just to notice it.
For those who want to correct this on their Windows system – as long as they’re running Vista or later, they can follow these instructions to fix the issues that are present in Windows operating system that allow for this vulnerability to be exploited. First, open command prompt, and type “gpedit.msc,” and press enter to search. At that point you’ll want to expand Computer Configuration, Administrative Templates, Network, and click on SSL Configuration Settings.
https://thehoopsnews.com/2015/03/09/3729/ford-builds-newest-ecoboost-engines-in-cleaveland/
Once the user has gotten this far they will have to look under SSL Configuration Settings, and click on the setting that reads “SSL Cipher Suite Order.” As the user scrolls to the bottom of this list that appears the user will see a statement that reads “How to modify this setting,” and this is where the user will have to enter – or copy and paste some information.
At this point the user will have to enter this cipher list to bring the entire system up to date.
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,
- TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
- TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
- TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
- TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
- TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
At that point the user will be able to press OK and restart the computer. That will generally correct most of the issues that are present within the coding and system. It’s important to note that a lot of the instructions and what should be done vary by the actual browser that is being run as well. This is something that is very crucial to follow – and many software options and browsers have already corrected many of the issues – or vowed to make updates soon to correct the outstanding security issues.