OpenSSL Upgrades FREAK Vulnerability to High Severity

The OpenSSL team upgraded FREAK to "high" severity today, due to the impact of the bug being far more widespread than initially thought. FREAK did impact OpenVPN, but did not impact VikingVPN because of our security topology.

First and foremost, FREAK requires two specific conditions in order to be exploitable. It requires a man-in-the-middle and it attacks OpenSSL autonegotiation. An attacker must be able to place themselves in the middle of the session, and then send fake data to the server to downgrade the encryption on their connection to the easily crackable Export RSA. The impact is huge as it breaks the encryption without notifying the client or the server that anything is wrong.

VikingVPN has a very tight security model specifically to protect users from these kinds of attacks. Firstly, we do not allow any negotiation on cipher to take place at all. We only use one cipher suite, the one that we believe is the strongest in the open-source OpenVPN client. The lack of autonegotiation already makes the FREAK attack impossible, but we also use the HMAC firewall to block man-in-the-middle attacks.

Some VPNs ARE VULNERABLE to FREAK

If a VPN provider allows negotiation of ciphers with the server (this is evidenced by VPN providers with custom clients that allow you to change the level of encryption you are using in the client) and they also do not use the HMAC firewall (if a line beginning with "tls-auth" is not present in the config file). Then the FREAK attack is possible to execute.

Furthermore, since this is likely VPNs with custom clients, to close this vulnerability they have to update the clients. You should keep your eyes on if the client has been updated since Jan 17th 2015. This is when the FREAK vulnerability was closed in the OpenVPN source, and it would need to be merged with all of their changes to the software and then released to their clients.

< last
next >