OpenSSL TLS Heartbeat Exploit

[ocabj]

https://www.openssl.org/news/secadv_20140407.txt

If you run 0.9.8, it's not vulnerable. But if you're running a 1.x branch, you better pull source and recompile ASAP. Remember to restart all OpenSSL linked services, or just reboot your box completely.

[ghost_shooter]

Missing bounds check for a security protocol layer? This is amazing!

[ocabj]

What sucks is that you can exfiltrate the server's private key. So even if after you patch, it's probably a good idea to rekey, regenerate a CSR, and reissue a new SSL certificate. Total PITA.

[Nobama4us]

https://github.com/titanous/heartbleeder

http://heartbleed.com/

[ocabj]

A lot of people who use the package manager in their respective Linux distro(s) to install OpenSSL instead of compiling from source are confused when the look at the dpkg logs (etc) and see libssl1.0.0 and think they're still vulnerable.

Here's a useful document:

https://library.linode.com/security/openssl-heartbleed

Pay attention to the openssl build date if you're installing from a package and not from source.

[ocabj]

https://github.com/titanous/heartbleeder
http://heartbleed.com/

I pulled the github code yesterday and have been using that. You can also just use the openssl CLI client and grep for specific output in the TLS transaction.

But the Heartbleed go code is nifty since it's easily scriptable (and uses posix-style exit codes).

[TMcC]

Eventually, part of the Internet population will realize that they need to change their credentials, everywhere. Some will, some wont. Many may miss that they need to do so after site $foo updates/rebuilds openssl - including new keys and certs. pita is a real understatement.

[Californio]

Now they are saying its in the routers and hubs also.

[Kestryll]

For those who are concerned Calguns.net does NOT use OpenSSL and is NOT vulnerable to the Heartbleed bug.

[laurelpark]

Thanks for this information!!! This is very good news.

What a nightmare this bug is. I don't think people realize how vulnerable they are. Everyone is running around changing their credentials on all the sites they use, and many of those sites have not implemented a fix yet. So, now that the bad guys have been very effectively notified of the vulnerability, and they're scrambling to exploit it during this window of opportunity, we have a ton of people changing their passwords and therefore broadcasting their credentials to the bad guys. It's just a matter of time before very sensitive accounts are hacked. This could get really bad...

For those who are concerned Calguns.net does NOT use OpenSSL and is NOT vulnerable to the Heartbleed bug.

[ocabj]

Frankly, heartbleed is being blown out of proportion by the media. Yes, it's a serious vulnerability that needs to be fixed. But at the same time, 99% of the people out there are being led to believe that the Internet is going to blow up because of this.

Now we have regular people at my workplace using various website tools to scan our servers as if they know what they're doing telling us we have SSL problems and our sites are insecure.

It's about as painful as listening to Democrats talk about barrel shrouds and ghost guns.

[NytWolf]

https://www.openssl.org/news/secadv_20140407.txt

If you run 0.9.8, it's not vulnerable. But if you're running a 1.x branch, you better pull source and recompile ASAP. Remember to restart all OpenSSL linked services, or just reboot your box completely.

Technically it's a bug, not an exploit. An exploit is when someone takes advantage of the vulnerability caused by the bug.

[Jason95357]

For those who are concerned Calguns.net does NOT use OpenSSL and is NOT vulnerable to the Heartbleed bug.

Hah, yeah, the one time where passwords in the clear ended up being more secure.

[ocabj]

Hah, yeah, the one time where passwords in the clear ended up being more secure.

Or in some cases, people still running the older 0.9.8 branch of OpenSSL.

[Jason95357]

Frankly, heartbleed is being blown out of proportion by the media. Yes, it's a serious vulnerability that needs to be fixed. But at the same time, 99% of the people out there are being led to believe that the Internet is going to blow up because of this.

Now we have regular people at my workplace using various website tools to scan our servers as if they know what they're doing telling us we have SSL problems and our sites are insecure.

It's about as painful as listening to Democrats talk about barrel shrouds and ghost guns.

It is not that big because of the behind the scenes work being done ahead of time.

That said, bad guys/nations are scanning for unpatched servers.