Microsoft is aware of a security feature bypass vulnerability in Secure Channel (Schannel) that affects all supported releases of Microsoft Windows. Our investigation has verified that the vulnerability could allow an attacker to force the downgrading of the cipher suites used in an SSL/TLS connection on a Windows client system. The vulnerability facilitates exploitation of the publicly disclosed FREAK technique, which is an industry-wide issue that is not specific to Windows operating systems.The good news is that Microsoft doesn't have any evidence to believe that the flaw has been exploited publicly to attack its customers. The bad news is that isn't proof that it hasn't happened, or that it won't happen now online criminals have been given the nod that such an attack might be possible. As it is, the FREAK (Factoring attack on RSA-EXPORT Keys, also known as CVE-2015-0204) vulnerability has been around for more than a decade, unnoticed by the security community until recently when it was uncovered by a group of researchers who discovered they were able to force websites into using weakened encryption, which it was then possible to crack within a few hours. Ironically, the FREAK problem only exists because in the 1990s the US government attempted to stop products being sold overseas if they incorporated strong encryption. Instead, it allowed "export-grade" (a synonym for "weak") encryption to be used instead. The silver lining on the cloud is that Microsoft says it is working on a fix, and successful exploitation of the FREAK vulnerability is probably less likely to be exploited widely than, say, the Heartbleed or Shellshock flaws. As Tripwire senior security analyst Ken Westin says, "It is still important to update systems as vendors make patches available." Wise words that we all should follow. Tripwire IP360 vulnerability management has included coverage for FREAK/CVE-2015-0204 since it was first released in January 2015, as well as detection capabilities for weak export grade ciphers that enable this attack vector. Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc. If you are interesting in contributing to The State of Security, contact us here.