[Ment]

?FREAK: Another day, another serious SSL security hole | ZDNet

The Washington Post reported today that cryptographers from IMDEA, a European Union research group; INRIA, a French research company; and Microsoft Research have found out that "They could force browsers to use the old export-grade encryption then crack it over the course of just a few hours. Once cracked, hackers could steal passwords and other personal information and potentially launch a broader attack on the Websites themselves by taking over elements on a page, such as a Facebook 'Like' button."

Basically you would be vulnerable where anyone has access to a router/wifi traffic or other network access where they could initiate a man-in-the-middle attack and break the weaker encryption.

Freak Attack Checker

I can confirm Firefox browser is not vulnerable.

[Dave Bourque]

Safe here

Posted via CB10

[Prem WatsApp]

Passport 10.3.0 apparently affected to some extent, 8-o

but blackberry.com is not listed as a site itself... :-)

�   "Oh Classic, you are the fairest here so true. But Passport is a thousand times more powerful than you..." (no offense, Classic is a great device, when it's charged)   �

[Prem WatsApp]

Should we "freak" out now and update...?

:-)

�   "Oh Classic, you are the fairest here so true. But Passport is a thousand times more powerful than you..." (no offense, Classic is a great device, when it's charged)   �

[Ment]

The pragmatic thing to do is not use banking etc on public wifi for the time being until browser and server updates are released. Your home connection is probably safe unless you have an hacker as a neighbor.

[howarmat]

I think chrome throws the same screen as you see with 10.3 above

[Ment]

N4BB says Freak affects all BB10 versions including 10.3.1.2267 . Guess the fix will come with the next OS update which hopefully fixes other bugs noted with 10.3.1 .

[kbz1960]

What I find funny is iOS has a date for the fix, android already patched it and bb the security expert is just investigating with no date for a fix. Security boss indeed.

[Bla1ze]

N4BB says Freak affects all BB10 versions including 10.3.1.2267 . Guess the fix will come with the next OS update which hopefully fixes other bugs noted with 10.3.1 .

That's not what was said at all.

Ars also learned from two unnamed sources that even BlackBerry OS 10.3.1.2267 is allegedly vulnerable. When visiting the test site https://freakattack.com it reveals the BlackBerry 10 browser is vulnerable.

And the comments from BlackBerry don't confirm or deny. Just that they're looking into it.

“BlackBerry is comprehensively investigating the “FREAK” vulnerability industry issue and we will take any action necessary to ensure our customers are protected.”

And as of now there's nothing on their advisory list concerning it, nor has it been published in the BlackBerry Knowledge Base.

http://ca.blackberry.com/enterprise/...sories-notices
http://btsc.webapps.blackberry.com/b...s/microsite.do

[Ment]

Incident Response Team - Canada

Lucas Atkins 9 hours ago


All known versions even up to the latest known. Not misleading anyone…

You and I both know BB is slow in putting out public info on vulnerabilities. Thats not surprising.

[Dave Bourque]

That's not was said at all.



And the comments from BlackBerry don't confirm or deny. Just that they're looking into it.



And as of now there's nothing on their advisory list concerning it, nor has it been published in the BlackBerry Knowledge Base.

http://ca.blackberry.com/enterprise/...sories-notices
http://btsc.webapps.blackberry.com/b...s/microsite.do

The screenshots above said I was fine. But now it says something different... kinda weird.



Posted via CB10

[Bla1ze]

You and I both know BB is slow in putting out public info on vulnerabilities. Thats not surprising.

Indeed but until they do it's hard to nail down which, if any versions, are affected. I've done the tests and come up both saying affected and not affected. Seems to be some shadiness in the testing.

Edit: Yup, Dave confirms it.. some weirdness in the testing.

[jic999]

Seems like BlackBerry patched it no Red warnings and freakattack.com cannot test the BlackBerry browser

Posted via CB10

[blackmoe]

Indeed but until they do it's hard to nail down which, if any versions, are affected. I've done the tests and come up both saying affected and not affected. Seems to be some shadiness in the testing.

Edit: Yup, Dave confirms it.. some weirdness in the testing.

The test could simply be checking your browser's User Agent string which is a lame test if true.

[yhamaie]

Indeed but until they do it's hard to nail down which, if any versions, are affected. I've done the tests and come up both saying affected and not affected. Seems to be some shadiness in the testing.

It has been revealed that all variations of Windows are vulnerable . . . I wonder if BlackBerry 10 OS and its browser are vulnerable.

Microsoft Security Advisory 3046015 - Vulnerability in Schannel Could Allow Security Feature Bypass

[Prem WatsApp]

The screenshots above said I was fine. But now it says something different... kinda weird.



Posted via CB10

That's weird, Dave. So your device shows a vulnerability now?
That's rather strange...

Let's see what's gonna happen.

�   "Oh Classic, you are the fairest here so true. But Passport is a thousand times more powerful than you..." (no offense, Classic is a great device, when it's charged)   �

[MADBRADNYC]

Uh oh?



T-Mobile Z10STL100-3/10.2.1.2228

I didn't check my Q10 yet, but it's probably the same since it's the same OS..

Posted via CB10

[TheBirdDog]

An unnamed source says that the primary target for FREAKers are those that run web based tests for their vulnerability. Once the test is run, you are 1/3rd more susceptible to an attack. Also, paranoia is statistically more apparent in people who consume more than the average amount of cottage cheese.

Posted via my BlackBerry Passport

[Prem WatsApp]

An unnamed source says that the primary target for FREAKers are those that run web based tests for their vulnerability. Once the test is run, you are 1/3rd more susceptible to an attack. Also, paranoia is statistically more apparent in people who consume more than the average amount of cottage cheese.

Posted via my BlackBerry Passport

Dude, link or go away... ;-D

J/k, love your comments, but hey, that cottage cheese thing needs closer scrutiny, haha... :-)

(so you reckon that website is a trap or target procurement effort, lol?)

�   "Oh Classic, you are the fairest here so true. But Passport is a thousand times more powerful than you..." (no offense, Classic is a great device, when it's charged)   �

[jic999]

I received the update on my Z30 via Rogers, but my Passport still tests Red is the update coming for the Passport and Classic in the major carriers ?

Posted via CB10