OpenSSL TLS Heartbeat Exploit

[bacon_lover]

Technically it's a bug, not an exploit. An exploit is when someone takes advantage of the vulnerability caused by the bug.

The NSA has reportedly been taking advantage of the vulnerability. If the reports are true, well, it wouldn't be surprising.

I've been running the Qualys SSL test against a bunch of firearms sites that I created accounts on or from which I've made purchases. Thus far the only one that shows up vulnerable is Daniel Defense's site.

[j-shot]

It is not that big because of the behind the scenes work being done ahead of time.

That said, bad guys/nations are scanning for unpatched servers.

True.

That happens 24x7 365 a year. Nothing new.

More true. Scans are always going down for O/S or device signatures.

[laurelpark]

I agree that it is being blown out of proportion - but that very media attention is what is making this so dangerous. Before Monday, most bad guys had no clue this vulnerability was there. When the news hit, it broadcast the vulnerability to everyone who might want to exploit it.

Most sites aren't doing much - the big guys are, but the mom and pop shops don't have the resources and probably won't for several weeks.

So, that leaves a window of opportunity open to the bad guys to scour the net for any vulnerable site - and grab whatever they can. What makes it bad is that things are blown so out of proportion that the average Joe is freaking out and going around changing usernames/passwords on all the sites he frequents.

The net result: many of the sites that the bad guys would not have bothered looking at are now potentially being compromised. At the same time, the bad guys are grabbing any data they can. Once they get someone's username/password, they know darned well that most people are lazy and they use the same username/password across dozens of sites.

Next thing to happen: people who just changed their username/password to "be safe" will find out that their accounts have started to get compromised. That's where it gets really ugly.

It sucks - I'm afraid to change a username/password anywhere unless that site has clearly stated that they have implemented a fix.

I wish this weren't as big a deal as it is. Fortunately or unfortunately, I work in the internet security business, and there is some serious freaking out going on - and it is real.

Frankly, heartbleed is being blown out of proportion by the media. Yes, it's a serious vulnerability that needs to be fixed. But at the same time, 99% of the people out there are being led to believe that the Internet is going to blow up because of this.

Now we have regular people at my workplace using various website tools to scan our servers as if they know what they're doing telling us we have SSL problems and our sites are insecure.

It's about as painful as listening to Democrats talk about barrel shrouds and ghost guns.

[TMcC]

That said, bad guys/nations are scanning for unpatched servers.

That happens 24x7 365 a year. Nothing new.

[Jason95357]

Frankly, heartbleed is being blown out of proportion by the media. Yes, it's a serious vulnerability that needs to be fixed. But at the same time, 99% of the people out there are being led to believe that the Internet is going to blow up because of this.

Now we have regular people at my workplace using various website tools to scan our servers as if they know what they're doing telling us we have SSL problems and our sites are insecure.

It's about as painful as listening to Democrats talk about barrel shrouds and ghost guns.

It is not that big because of the behind the scenes work being done ahead of time.

That said, bad guys/nations are scanning for unpatched servers.

[ocabj]

Hah, yeah, the one time where passwords in the clear ended up being more secure.

Or in some cases, people still running the older 0.9.8 branch of OpenSSL.

[Jason95357]

For those who are concerned Calguns.net does NOT use OpenSSL and is NOT vulnerable to the Heartbleed bug.

Hah, yeah, the one time where passwords in the clear ended up being more secure.

[NytWolf]

https://www.openssl.org/news/secadv_20140407.txt

If you run 0.9.8, it's not vulnerable. But if you're running a 1.x branch, you better pull source and recompile ASAP. Remember to restart all OpenSSL linked services, or just reboot your box completely.

Technically it's a bug, not an exploit. An exploit is when someone takes advantage of the vulnerability caused by the bug.

[ocabj]

Frankly, heartbleed is being blown out of proportion by the media. Yes, it's a serious vulnerability that needs to be fixed. But at the same time, 99% of the people out there are being led to believe that the Internet is going to blow up because of this.

Now we have regular people at my workplace using various website tools to scan our servers as if they know what they're doing telling us we have SSL problems and our sites are insecure.

It's about as painful as listening to Democrats talk about barrel shrouds and ghost guns.

[laurelpark]

Thanks for this information!!! This is very good news.

What a nightmare this bug is. I don't think people realize how vulnerable they are. Everyone is running around changing their credentials on all the sites they use, and many of those sites have not implemented a fix yet. So, now that the bad guys have been very effectively notified of the vulnerability, and they're scrambling to exploit it during this window of opportunity, we have a ton of people changing their passwords and therefore broadcasting their credentials to the bad guys. It's just a matter of time before very sensitive accounts are hacked. This could get really bad...

For those who are concerned Calguns.net does NOT use OpenSSL and is NOT vulnerable to the Heartbleed bug.

[Kestryll]

For those who are concerned Calguns.net does NOT use OpenSSL and is NOT vulnerable to the Heartbleed bug.

[Californio]

Now they are saying its in the routers and hubs also.

[TMcC]

Eventually, part of the Internet population will realize that they need to change their credentials, everywhere. Some will, some wont. Many may miss that they need to do so after site $foo updates/rebuilds openssl - including new keys and certs. pita is a real understatement.

[ocabj]

https://github.com/titanous/heartbleeder
http://heartbleed.com/

I pulled the github code yesterday and have been using that. You can also just use the openssl CLI client and grep for specific output in the TLS transaction.

But the Heartbleed go code is nifty since it's easily scriptable (and uses posix-style exit codes).

[ocabj]

A lot of people who use the package manager in their respective Linux distro(s) to install OpenSSL instead of compiling from source are confused when the look at the dpkg logs (etc) and see libssl1.0.0 and think they're still vulnerable.

Here's a useful document:

https://library.linode.com/security/openssl-heartbleed

Pay attention to the openssl build date if you're installing from a package and not from source.