RJ MAC USER
Level 1 (0 points)

Q: FREAK & Safari

Hello,

 

I am running MAC OS 10.10.2 with all security updates installed.  When checking Safari's vulnerability to FREAK using https://freakattack.com it reports the following message: Warning! Your browser offers RSA_EXPORT cipher suites. It can be tricked into using weak encryption if you visit a vulnerable website. We encourage you to update your browser right away.

 

According to the security notes on "Security Update 2015-02" this was supposed to be be fixed.   Apple security updates - Apple Support

 

Is anybody else having the problem? If, so what did you do to resolve this?

 

Thanks for the help

 

RJ MAC User

MacBook Pro, OS X Yosemite (10.10.2), Safari Version 8.0.4

Posted on Mar 25, 2015 8:50 AM

Close
RJ MAC USER

Q: FREAK & Safari

  • All replies
  • Helpful answers

  • by Linc Davis,

    Linc Davis Linc Davis Mar 25, 2015 3:11 PM in response to RJ MAC USER
    Level 10 (207,963 points)
    Applications
    Mar 25, 2015 3:11 PM in response to RJ MAC USER

    Security Update 2015-003 Yosemite

  • by RJ MAC USER,

    RJ MAC USER RJ MAC USER Mar 25, 2015 4:10 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 25, 2015 4:10 PM in response to Linc Davis

    Hello Linc,

     

    Installed the update. I also discovered I have the same problem with Google Chrome. Same error message.

    Any more thoughts you may have.

     

    Thanks

    RJ

  • by Linc Davis,

    Linc Davis Linc Davis Mar 25, 2015 4:13 PM in response to RJ MAC USER
    Level 10 (207,963 points)
    Applications
    Mar 25, 2015 4:13 PM in response to RJ MAC USER

    Are you connecting through an HTTPS proxy, or have you installed "anti-virus" software such as "Avast?"

  • by RJ MAC USER,

    RJ MAC USER RJ MAC USER Mar 25, 2015 4:15 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 25, 2015 4:15 PM in response to Linc Davis

    Direct internet connect...Running Avast for Business

  • by Linc Davis,

    Linc Davis Linc Davis Mar 25, 2015 4:20 PM in response to RJ MAC USER
    Level 10 (207,963 points)
    Applications
    Mar 25, 2015 4:20 PM in response to RJ MAC USER

    "Avast" is the worst of the whole wretched lot of commercial "security" products for the Mac. Not only does it fail to protect you from any real danger, it may send personal data (such as web browsing history and the contents of email messages) back to the developer without your knowledge, give false warnings, destabilize and slow down the computer, expose you to network attack, and corrupt the network settings and the permissions of files in your home folder. Removing it may not repair all the damage.

    Some versions of the product also inject advertising into web pages. In short, apart from the fine print in the license agreement, Avast is indistinguishable from malware, and is arguably worse than any known malware now in circulation.

    Back up all data, then remove Avast according to the developer's instructions. Restart.

    If you tried to remove Avast by dragging an application to the Trash, you'll have to reinstall it and then follow the instructions linked above.

  • by RJ MAC USER,

    RJ MAC USER RJ MAC USER Mar 25, 2015 9:12 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 25, 2015 9:12 PM in response to Linc Davis

    Hello Linc,

     

    When I uninstalled Avast the problem was resolved. I wanted to know what in Avast was causing the problem.  I reinstalled Avast and tested. I discovered if I uncheck the "scan secured connections" the problem goes away.  I would suspect the problem is caused by the AV trying to access the secure data.

     

    Thanks for your help.

    RJScreen Shot 2015-03-25 at 9.01.47 PM.png

  • by Linc Davis,

    Linc Davis Linc Davis Mar 25, 2015 9:26 PM in response to RJ MAC USER
    Level 10 (207,963 points)
    Applications
    Mar 25, 2015 9:26 PM in response to RJ MAC USER

    "Avast" tampers with the trust subsystem by installing a false root certificate. That's exactly the kind of thing a malware attacker would do. As I wrote earlier, "Avast" is no different from malware in any essential way.