How can I protect my phone from the FREAK bug? Phone is a Samsung GT-S5830 running Gingerbread.
Use browsers (e.g. FireFox) that are proven to be not vulnerable to FREAK bug and try to avoid these sites until they've fixed their server. The bug is not device-dependant nor Android version-dependant.
Who is vulnerable?
The FREAK attack is possible when a vulnerable browser connects to a susceptible web server—a server that accepts "export-grade" encryption.
Update (Mar. 5): Browsers are vulnerable to the FREAK attack because of bugs that allow an attacker to force them to use weak, export-grade encryption. One example is the OpenSSL bug described in CVE-2015-0204, but some other TLS libraries have similar problems. Far more browsers are vulnerable to the FREAK attack than was initially thought when the attack was announced, including:
- Chrome on Android
- Stock Android Browser
You can check whether your browser is vulnerable using our FREAK Client Test Tool.
Chrome for Windows and all versions of Firefox are known to be safe. However, even if your browser is safe, certain third-party software, including some anti-virus products and adware programs, can expose you to the attack by intercepting TLS connections from the browser. If you are using a safe browser but our client test says you’re vulnerable, this is a likely cause.
What should I do?
If you use a browser …
Make sure you have the most recent version of your browser installed, and check for updates frequently. Updates that fix the FREAK attack should be available for all major browsers soon.