HeartBleed

[scootle]

Seems Calguns.net might want to consider checking their OpenSSL (if not already) and reissuing their certs?

Not sure if this affects us at CalGuns, but since I'm here almost every day, I thought I'd check.

[decepticon6551]

I've never seen that before. I use LastPass on Chrome, IE, and Android.

[lazyworm]

current cert was issued in 2011, so definitely not addressed.

Kes, layman explanation is that there is a bug with the encryption library called OpenSSL.
This bug allows anybody to steal the secret encryption key for your web server. This means whomever has your key can also decrypted the traffic to/from calguns.net.

If the current servers are using version 1.0.1 or 1.0.2, you're vulnerable.

Fix is a 2 step process
1) upgrade OpenSSL to a fixed version 1.0.1g
2) work with your cert issuer to reissue a cert using a new private key.

I'm sure there are enough techies around to help. Let me/us know.

You can read further about this at http://heartbleed.com/

[scootle]

+1 to lazyworm.

I'm not sure CalGuns.net ever uses SSL since I've never noticed it going to https even when asking for our credentials, but perhaps now is a good time to swap over.

Regardless, the SSL certs need to be reissued after the patch/update.

edit: I should add... any and all users should go ahead and use the free checker at LastPass for any and all sites they log into and/or contain personal information: https://lastpass.com/heartbleed/
(no, I don't work for LastPass, nor am I subscriber to their service.)

[TacticalPlinker]

Anyone care to elaborate on this virus? There was an "high priority alert" about it earlier today at work, but I did not get a chance to research it.











(I also got an e-mail about reminding us company policy does not permit "possession of dangerous weapons, firearms, or explosives while on Company owned or leased property". I'm guessing this "reminder" was their "response" to the "incident" this morning in Pittsburgh. )
.
.

[scootle]

Anyone care to elaborate on this virus? There was an "high priority alert" about it earlier today at work, but I did not get a chance to research it.

(I also got an e-mail about reminding us company policy does not permit "possession of dangerous weapons, firearms, or explosives while on Company owned or leased property". I'm guessing this "reminder" was their "response" to the "incident" this morning in Pittsburgh. )
.
.

It's not a virus so much as a huge vulnerability in OpenSSL that was recently found.

Official info is here: http://heartbleed.com/
A good layman read about the issue is here on LifeHacker: http://lifehacker.com/what-the-heart...you-1560801201
ars technica: http://arstechnica.com/security/2014...oulette-style/

As an end user, there is nothing you can do other than wait until you are sure your affected sites update their OpenSSL (if needed) and then re-issue their security certificates before changing your password(s).

[ocabj]

This thread is so full of misleading information.

Read this:

https://www.openssl.org/news/secadv_20140407.txt

That lastpass check is useless. Download and compile one these github repos:

https://github.com/FiloSottile/Heartbleed

https://github.com/titanous/heartbleeder

It actually performs the TLS handshake and tries to exploit the heartbeat memory bound exploit to confirm if the site is vulnerable.

$ ./Heartbleed calguns.net:443
2014/04/09 18:10:41 calguns.net:443 - SAFE

$ ./heartbleeder calguns.net
SECURE - calguns.net:443 does not have the heartbeat extension enabled