Millions of Apple and Google customers are vulnerable to a decades-old 'FREAK' hack
The security flaw affects Android and iOS users who use the default Chrome or Safari browsers. Both companies are now rushing to bring out a fix.
So what is "FREAK"?
It stands for Factoring attacks on RSA-EXPORT Keys. To understand what that it, you need to know about the history of cryptography.
Back in the 1990s, there was a debate over the use of cryptography to secure websites. Researchers and developers argued it was essential to protect people's confidential details, while the authorities argued it threw up dangerous barriers to law enforcement.
Ultimately, a limit of 512-bit was placed on the strength of encryption in software that could be exported from America. This meant authorities could, if need be, intercept communications of products that has this encryption strength. These limits were later relaxed and encryption became considerably stronger. But the early restrictions had a nasty effect.
"The weaker encryption got baked into widely used software that proliferated around the world and back into the United States, apparently unnoticed until this year," The Washington Post explains.
This means that many websites and browsers are still programmed to provide 512-bit keys for security when requested, even though they can be cracked in a matter of hours.
As a result, a hacker could go to an affected website, obtain its weak key, crack it, then be able to impersonate that website and intercept traffic to the site on the same network as them. It's what's often called a "man in the middle" attack. On your home WiFi you're probably safe, but you could be targeted whenever you log on to a public network, like a a coffee shop, or a hotel, or an airport.
The list of websites affected is extremely extensive. Banks like American Express and Santander are vulnerable, along with other major websites like Groupon, hotel chain Marriott, and shopping site J-Crew. At one point, the websites of the White House, the NSA, and the FBI were all affected, according to the Washington Post, although they've since implemented fixes. According to one site dedicated to tracking FREAK, 9.7% of the Alexa Top 1 Million websites are affected (down from 12.2% as people begin to patch the issue).
What this means in real terms is that when you're shopping online, or checking your bank statement, or logging onto one of your favourite sites, hackers may be harvesting your sensitive personal information. There's no confirmed uses of FREAK to harvest personal data - but the vulnerability has existed for decades, so it's not unthinkable to suggest it may have been used.
And the reason FREAK exists isn't because of shoddy coding by a developer - it's because the government wanted a "backdoor" into encryption products when necessary. As debate over the use of encryption begins to flare up once again, researchers are already pointing to FREAK as evidence developers shouldn't weaken their encryption products at the request of law enforcement.
"Encryption backdoors will always turn around and bite you in the ass," writes Matthew Green. "They are never worth it."