Web browsers, email servers and Web servers used by a significant percentage of the online population may be at risk of a recently uncovered flaw called Logjam, which cybercriminals could use to collect weakly encrypted data traffic and quickly decode it, a team of researchers has warned.
A website called WeakDH.org has been set up to help computer users test their Web browsers for the flaw, which will be indicated by a red warning banner. Logjam was first described in a research paper published by a team that included researchers from Microsoft, INRIA, Johns Hopkins University, the University of Michigan and the University of Pennsylvania. The “dh” in the site name refers to Diffie-Hellman, a set of algorithms that process secure connections via encryption keys. The flaw lies in the nearly 20-year-old Secure Sockets Layer (SSL) protocol. If present, it could force Web servers to use 512-bit encryption keys rather than the stronger versions typical of most sites today.
As CSO Online explained, Logjam’s origins may be traced back to government policies that prohibited strong encryption in products as part of a national security policy. Though such policies were changed long ago, some sites still use 512-bit encryption, and browsers continue to support them so users don’t experience access issues.
Computerworld, meanwhile, noted that Logjam is different from the factoring RSA export keys exploit, otherwise known as the FREAK flaw, because while the latter merely opened a hole of sorts, this new vulnerability can be used to manipulate Web servers to make weak encryption appear stronger.
Microsoft has already dealt with Logjam on Internet Explorer, while Google spokespeople told The Wall Street Journal a patch for Chrome would arrive in the coming weeks. That still leaves Firefox and Safari vulnerable, not to mention the onerous process of testing Web and email servers.
Although there is obviously cause for concern, an expert interviewed by Tom’s Guide suggested the risk for Logjam may be minimal because it requires an attacker to be on the same public network as the potential victim. Given how often businesspeople are doing work in coffee shops and similar environments, however, it’s better to be on the safe side and make sure those Internet connections are as secure as we often assume they are.