Stop the presses: HTTPS-crippling “FREAK” bug affects Windows after all
Microsoft advisory dramatically raises the number of vulnerable end-user devices. — Computers running all supported versions of Microsoft Windows are vulnerable to “FREAK,” a bug disclosed Monday that for more than a decade …
Context & Ripple Effects
When researchers first disclosed FREAK on March 4, the story was framed as a flaw in Google and Apple devices — a decade-old weakness in export-grade cryptography enabling man-in-the-middle attacks on HTTPS. Microsoft was not named among the affected vendors.
That changed with this advisory: all supported versions of Windows are vulnerable, which turns a mobile-device story into an enterprise-wide one given the size of the Windows installed base. Days earlier, coverage had already shown the exploit reaching thousands of Android and iOS apps, so each vendor confirmation widens the same attack surface rather than opening a new one.
First-order effects
- Every organization running supported Windows must treat outbound HTTPS from those machines as potentially interceptable until patched, and Microsoft has to reverse its earlier implicit 'not affected' posture with a public advisory.
Second-order effects
- Server operators face pressure to disable export-grade cipher suites outright, since client-side patches alone don't help if servers still negotiate the weak ciphers; the app-level exposure on Android and iOS shows the fix has to happen on both ends of every connection.
Third-order effects
- FREAK fits a recurring pattern in Microsoft's own track record — code lingering for years before exploitation, as with the later critical flaw in a cryptographic component present in all Windows versions that NSA flagged, and the wormable flaw Check Point said had been in the code for 17 years. The structural lesson is that legacy crypto and old code paths inside dominant OSes become a standing national-security-adjacent liability, not just a patch-cycle nuisance.
The trend: Decades-old cryptographic weaknesses embedded in mainstream operating systems keep resurfacing as attack surface, pushing vendors toward auditing and removing legacy code rather than patching symptoms.