LogJam Attack

A new SSL/TLS vulnerability dubbed as “LogJam attack” was disclosed by researchers today.  The flaw exists in Diffie-Hellman Key exchange which is used by a number of popular protocols such as HTTPS, SSH, IPSec, and SMTPS. The Logjam attack affects any server that supports DHE_EXPORT ciphers and most of the modern web browsers which support short Diffie-Hellman parameters. According to data published by the researchers at weakdh.org, the vulnerability affects around 8.4% of the Top 1 million domains, 3.4% of HTTPS Browser Trusted Sites, 14.8%, 8.9% and 8.4% of Email servers using SMTP with StartTLS, POP3S and IMAPS respectively. The vulnerability is similar to FREAK attack discovered in March this year. Freak attack was due to a flaw in the implementation while LogJam is due to a flaw in the design of SSL/TLS protocol.

The LogJam attack allows man-in-the-middle attacker to force the client and server to use a weak cipher such as 512-bit DHE_EXPORT thereby decrypting and listening-in on an encrypted communication channel.  The details published here show that the attack can be performed in both offline and online manner.  Either of the scenarios allows unauthorized disclosure of information; unauthorized modification of data; and allows for disruption of service.

If you are a SaaS app vendor using SSL/TLS, you should disable support for export cipher suites. It is also recommended to deploy (Ephemeral) Elliptic-Curve Diffie-Hellman (ECDHE) and generate a unique 2048-bit Diffie-Hellman group. You can find more guidance and an online tool to test your web server here.

If you are an enterprise with users accessing SaaS apps and other HTTPS websites, please upgrade your users browsers to the latest fixed versions. If your enterprise uses any tools with SSL/TLS libraries, ensure to upgrade to latest versions with the fix.