Heartbleed Bug: Serious Hole in Internet Security

[zanejohnson]

i want you guys to think very hard about this for a while, about how the exploit works, the level of the infrastructure it works at.... now scale that down or up... down to the microprocessors made overseas by countries who understand that the real race..is the race to create the backdoor, the trojan horse, real......mutual assured destruction.//

now think about how far up that can scale as well, as in missile technology....................now think about the banking system and how it's come to light recently about the latency haXx and such involved in the stock markets, and how certain entitys invest bookoo money in real estate as close to the stock exchange servers as possible....

now... think about cryptocoin, and how that can render that......well.. inert.


there's alot going on, a whole, whole lot.... watch everything.

 

[spidey07]

how do I as a user ensure that the certs have been re-issued? do I need to check the date, or is there some revocation process that happens automatically?

Assume your ssl session is not secure. That the conversation is clear text.

Revocation is not clean nor easy to do

Check the date on the cert and call the operator.

 

[Crusty]

Assume your ssl session is not secure. That the conversation is clear text.

Revocation is not clean nor easy to do

Check the date on the cert and call the operator.

The dates don't matter. If you go to your CA and ask for a reissue with a new CSR they are not obligated to extend your cert's expiration date or to change the issuing date to be the new/current date.

If you see a cert that was issued AFTER you know the server using the cert has been patched then you know you are good, otherwise, you gotta ask the service provider.

 

[Lean L]

The dates don't matter. If you go to your CA and ask for a reissue with a new CSR they are not obligated to extend your cert's expiration date or to change the issuing date to be the new/current date.

If you see a cert that was issued AFTER you know the server using the cert has been patched then you know you are good, otherwise, you gotta ask the service provider.

What a pain... They should just start an initiative to revoke all certs immediately.

 

[spidey07]

The dates don't matter. If you go to your CA and ask for a reissue with a new CSR they are not obligated to extend your cert's expiration date or to change the issuing date to be the new/current date.

If you see a cert that was issued AFTER you know the server using the cert has been patched then you know you are good, otherwise, you gotta ask the service provider.

Exactly. The cert must be issued after the fix.

 

[tfinch2]

I haven't looked at the code or RFC so there may be a good reason, but why on Earth would heartbeat need to send up to 64k worth of data?

 

[halik]

This is a REALLY big deal. An attacker can get the root cert's private key rendering SSL and anything cert based encryption worthless. I won't be doing any online banking for a while.

If they get the private key not only can they decrypt your stuff, they can issue bogus certs that your browser would see as valid and trust.

Apparently it cannot, openssl has their own version of malloc in a segregated memory space and doesn't keep the private key there.

http://blog.erratasec.com/2014/04/w...y.html?showComment=1397079735462#.U0ak6K1dVhs

EDIT: JK, apparently this guy isn't right about the freeing part. It is unlikely you'll actually get the private key back:
http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html

 

[spidey07]

What a pain... They should just start an initiative to revoke all certs immediately.

That would be ideal. But imagine what that involves.

The trust is broken.

 

[IronWing]

Any sites have a list of sites for the bigger banks/retailers/etc that have been fixed?

 

[AViking]

Is this mostly a US problem or is it global?

 

[tfinch2]

Is this mostly a US problem or is it global?

Global

 

[PowerEngineer]

Any sites have a list of sites for the bigger banks/retailers/etc that have been fixed?

"top 10,000" sites as of today:

https://github.com/musalbas/heartbleed-masstest/blob/master/top10000-10-Apr-14-1100UTC.txt

 

[Virgorising]

http://www.huffingtonpost.com/2014/04/10/heartbleed-bug_n_5120457.html

Penny wise, pound foolish. Not unlike General Motors. Just shocking.

 

[IronWing]

"top 10,000" sites as of today:

https://github.com/musalbas/heartbleed-masstest/blob/master/top10000-10-Apr-14-1100UTC.txt

Thanks!

 

[Virgorising]

"top 10,000" sites as of today:

https://github.com/musalbas/heartbleed-masstest/blob/master/top10000-10-Apr-14-1100UTC.txt

Thanks for this! I am relieved, even surprised, PayPal, Twitter, Amazon are not among the vulnerable ones.

I feel a little better. Not much, but a little.

 

[Lean L]

http://www.huffingtonpost.com/2014/04/10/heartbleed-bug_n_5120457.html

Penny wise, pound foolish. Not unlike General Motors. Just shocking.

What?

Why did this article read as if the author had no idea what the exploit was or how any of this works?

Bad comparison to GM imo.

 

[Virgorising]

Bad comparison to GM imo.

I stand by the parallel. Follow the money....rather, the unwillingness to spend it.

 

[Lean L]

I don't even see a parallel.

The chain goes like this.

Corporation buys red hat that has apache as a default package that uses openssl that uses c, a whole bunch of other libraries, etc... not to mention all the rfcs that govern tcp/ip, the ieee rules that govern how devices communicate...

You want companies to pay royalties all the way down the chain? It's an unlimited loop, and you'd end up with no money at all.

If you wanted to argue relying on open source in large scale production... that might be worth talking about.

 

[Virgorising]

I don't even see a parallel.

The chain goes like this.

Corporation buys red hat that has apache as a default package that uses openssl that uses c, a whole bunch of other libraries, etc... not to mention all the rfcs that govern tcp/ip, the ieee rules that govern how devices communicate...

You want companies to pay royalties all the way down the chain? It's an unlimited loop, and you'd end up with no money at all.

If you wanted to argue relying on open source in large scale production... that might be worth talking about.

Most of the programmers who work on OpenSSL have other jobs during the day and maintain the software in their spare time. The programmers don’t have time to check every line of code for flaws and can’t afford to pay someone else to do it. A formal audit of software code can cost at least $100,000 and often costs much more, according to Laurie.
“We simply don’t have the funding for that,” Marquess said. “The funding we have is to support food and rent for people doing the most work on OpenSSL.”
He added that the foundation’s funding pales in comparison to other open-source projects. “The irony here is everyone uses it and no one supports it financially," he said.

 

[CZroe]

I can't believe DailyTech hasn't even mentioned this yet.

This is a REALLY big deal. An attacker can get the root cert's private key rendering SSL and anything cert based encryption worthless. I won't be doing any online banking for a while.

If they get the private key not only can they decrypt your stuff, they can issue bogus certs that your browser would see as valid and trust.

Luckily, virtually no government or financial institutions used OpenSSL, but almost everyone else did. Unlike the iOS vulnerability earlier this year, every app, every service, and every OS using OpenSSL remains vulnerable until every one of those are patched.

 

[Lean L]

Most of the programmers who work on OpenSSL have other jobs during the day and maintain the software in their spare time. The programmers don’t have time to check every line of code for flaws and can’t afford to pay someone else to do it. A formal audit of software code can cost at least $100,000 and often costs much more, according to Laurie.
“We simply don’t have the funding for that,” Marquess said. “The funding we have is to support food and rent for people doing the most work on OpenSSL.”
He added that the foundation’s funding pales in comparison to other open-source projects. “The irony here is everyone uses it and no one supports it financially," he said.

So who do you propose support them? Customers separated by three levels?

 

[OutHouse]

I am a Network Engineer. So yeah I sort of do.

 

[Brian Stirling]

As dramatic as the possibility is, the reality is that the bug is rather mundane, and they already know exactly where it came from and what programmer introduced it. A UK-based developer was adding a feature and decided to roll his own memory dealloc rather than handing the block back to free. The library routine had code in place that would have seg faulted on his error, but his own code did not.

The bug is very serious, category 11 as Schneier put it, because everyone has to assume everything was taken. The reality is probably that very little was taken. Hunting for keys by grabbing random 64k blocks isn't all that efficient, given that there may be more than a half-million or so such blocks available in a typical server (rough estimate).

Still, doesn't matter much. We all have to respond as if every try was successful.

Yeah, perhaps, the thing is when the NSA has there hands on important net security code AND there mission is spying I don't think it's much of a stretch to suspect nefarious intentions when they help us with coding network security things. If we learned anything from Snowden it is that the NSA, and other spy agencies, are doing EVERYTHING they can.

To be sure, there are others that through negligence or intent mess things up in a way that weaken security and privacy and I'm not happy about that either. My point, though, is that when the NSA leaves exploits in code we all use for their purposes it makes us vulnerable not only to their actions but to anyone that finds them.


Brian

 

[Markbnj]

If we learned anything from Snowden it is that the NSA, and other spy agencies, are doing EVERYTHING they can.

Agreed, which is why I'm fairly sure Schneier's comment about the NSA furiously trying to exploit the bug since Monday morning was not tongue-in-cheek.

 

[Imp]

I'll change my passwords in a week or two, but meh.