A frightening new vulnerability could let hackers bypass the one thing that keeps us safe online
And there's even more bad news about our current encryption practices: The paper discussing this vulnerability also revealed that what are considered 'midlevel' encryption keys are actually easier to crack that originally thought.
This means that if a website uses these keys, well-resourced attackers can actually intercept those communications too.
The ramifications of LogJam are huge on a theoretical level, though perhaps less so in application. What makes the vulnerability seem so threatening is the idea that the current practice in place for protecting our online identities may not be as secure as we think. "Cryptography makes certain promises about confidentiality, and this vulnerability violates that trust," Tod Beardsley from security firm Rapid7 wrote in a statement.In that sense, LogJam is similar to the Heartbleed bug, which was thought by many to be one of the most chilling online bug discoveries.Still, the point of entry for LogJam is very slight. The only way to successfully capitalize on the LogJam bug is to be on the same network as the person you're trying to intercept at the same time as them. Otherwise, you would need extensive digital resources, such as those granted to the government.
"Either they are real close by - in the same network," said Beardsley in a phone conversation with Business Insider. "Or, they are in the internet." This latter part means state actors who "control a big chunk of whatever the backbone is."In other words, unless the attacker is sharing the same Wi-Fi network as you, it's extremely difficult to perform this attack unless your part of a large-scale surveillance program backed by millions of dollars.
All the same, the ramifications are still palpable. LogJam creates the sort of encryption backdoor at which state sponsored surveillance rings would salivate.
Following this news, browsers are already scrambling to implement patches to fix the problem. Google and Mozilla both responded to The Wall Street Journal saying their browsers would not support these weak keys within the coming weeks. Additionally, many of the servers still using these weak keys are scrambling to update their systems.