Web Security is happening subject these days. There is always something to keep Security Expert busy and vulnerabilities name is a bit catchy like Heart Bleed, Poodle, and now Freak Attack. In this guide, I will explain how to identify if your website is affected and the procedure to fix the vulnerabilities.

Introduction

If you are interested or don’t know about Freak Attack then here are few words. Karthikeyan Bhargavan discovered FREAK attack vulnerability at INRIA in Paris. It was announced on 3rd March 2015 that new SSL/TLS vulnerability would allow an attacker to intercept HTTPS connection between vulnerable client and server and the ability to force them to use weak encryption. This will help an attacker to steal or manipulate sensitive data.

Check if your server is vulnerable

If your Web Server accepts RSA_EXPORT cipher suites then you are at risk. You can perform a check against your HTTPS URL at the following link.

https://www.ssllabs.com/ssltest/ https://geekflare.com/tools/tls-scanner https://tools.keycdn.com/freak

Fix FREAK Attack Security Vulnerability

Apache HTTP Server – you can disable EXPORT cipher suites by adding below in your httpd.conf or SSL configuration file. You may already have an SSLCipherSuite line in your configuration file. If so, you just need to add !EXPORT at end of the line. If you are new to the configuration, you can read my Apache Web Server Security & Hardening Guide. Nginx – add the following in your configuration file. Additionally, you can use the SSL Configuration Generator or Mozilla Recommended Configuration to protect with SSL/TLS vulnerabilities. As a website owner or security engineer, you should regularly perform a security scan against your website to find out for any new vulnerabilities and get notified. You may also be interested in fixing the Logjam attack.

How to test FREAK Attack  CVE 2015 0204  and Fix  - 90How to test FREAK Attack  CVE 2015 0204  and Fix  - 78How to test FREAK Attack  CVE 2015 0204  and Fix  - 94How to test FREAK Attack  CVE 2015 0204  and Fix  - 21How to test FREAK Attack  CVE 2015 0204  and Fix  - 61How to test FREAK Attack  CVE 2015 0204  and Fix  - 59How to test FREAK Attack  CVE 2015 0204  and Fix  - 42How to test FREAK Attack  CVE 2015 0204  and Fix  - 14How to test FREAK Attack  CVE 2015 0204  and Fix  - 57How to test FREAK Attack  CVE 2015 0204  and Fix  - 22How to test FREAK Attack  CVE 2015 0204  and Fix  - 89How to test FREAK Attack  CVE 2015 0204  and Fix  - 79How to test FREAK Attack  CVE 2015 0204  and Fix  - 72How to test FREAK Attack  CVE 2015 0204  and Fix  - 13How to test FREAK Attack  CVE 2015 0204  and Fix  - 38How to test FREAK Attack  CVE 2015 0204  and Fix  - 71How to test FREAK Attack  CVE 2015 0204  and Fix  - 48How to test FREAK Attack  CVE 2015 0204  and Fix  - 72How to test FREAK Attack  CVE 2015 0204  and Fix  - 91How to test FREAK Attack  CVE 2015 0204  and Fix  - 21How to test FREAK Attack  CVE 2015 0204  and Fix  - 70How to test FREAK Attack  CVE 2015 0204  and Fix  - 60How to test FREAK Attack  CVE 2015 0204  and Fix  - 84