May 21, 2015 By Shane Schick 2 min read

Web browsers, email servers and Web servers used by a significant percentage of the online population may be at risk of a recently uncovered flaw called Logjam, which cybercriminals could use to collect weakly encrypted data traffic and quickly decode it, a team of researchers has warned.

A website called WeakDH.org has been set up to help computer users test their Web browsers for the flaw, which will be indicated by a red warning banner. Logjam was first described in a research paper published by a team that included researchers from Microsoft, INRIA, Johns Hopkins University, the University of Michigan and the University of Pennsylvania. The “dh” in the site name refers to Diffie-Hellman, a set of algorithms that process secure connections via encryption keys. The flaw lies in the nearly 20-year-old Secure Sockets Layer (SSL) protocol. If present, it could force Web servers to use 512-bit encryption keys rather than the stronger versions typical of most sites today.

As CSO Online explained, Logjam’s origins may be traced back to government policies that prohibited strong encryption in products as part of a national security policy. Though such policies were changed long ago, some sites still use 512-bit encryption, and browsers continue to support them so users don’t experience access issues.

Computerworld, meanwhile, noted that Logjam is different from the factoring RSA export keys exploit, otherwise known as the FREAK flaw, because while the latter merely opened a hole of sorts, this new vulnerability can be used to manipulate Web servers to make weak encryption appear stronger.

Microsoft has already dealt with Logjam on Internet Explorer, while Google spokespeople told The Wall Street Journal a patch for Chrome would arrive in the coming weeks. That still leaves Firefox and Safari vulnerable, not to mention the onerous process of testing Web and email servers.

Although there is obviously cause for concern, an expert interviewed by Tom’s Guide suggested the risk for Logjam may be minimal because it requires an attacker to be on the same public network as the potential victim. Given how often businesspeople are doing work in coffee shops and similar environments, however, it’s better to be on the safe side and make sure those Internet connections are as secure as we often assume they are.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today