Heartbleed Bug: Serious Hole in Internet Security

[Markbnj]

Not only do you have to patch, you have to re-issue new certificates. About it being unknown is wishful thinking because again there is no way at all to tell if somebody was doing it.

I can assure you there are very smart hackers that are constantly trying to hack SSL. Getting the private keys to the cert is the gold mine jackpot. If somebody looked at the source code for it I'm sure they could easily reverse engineer it and notice the memory problem. Being open source I would assume the source code is readily available?

The cert thing is a definite pain in the ass, but it mostly hits orgs with the resources to deal with it. And as has been said elsewhere, maybe the cost will be a kick in the tail that encourages them to get more involved and put some dollars where their interests lie.

Anyway, I have nothing to go on other than my instinct, which still leans towards "It'll blow over relatively quickly."

 

[Imp]

Roh roh, network gear also affected.

Oh, horseshit. I hope it's just business/enterprise class stuff. I can't find my router, a Cisco that became a Linksys, on either Cisco or Linksys' sites -- but it's an "in-between" companies product.

 

[FelixDeCat]

this too shall pass.

 

[Virgorising]

Heads up! When I came home just earlier, turned on radio, I heard them say some German guy came forth and said he wrote this bug BY MISTAKE! I AM NOT KIDDING!!!!!

I am now trying to find an account of this online. But It was on WINS News, NYC.
________________________________
Edit!

http://www.latimes.com/business/tec...ed-bug-20140410,0,2676251.story#axzz2ybVT8qGi

 

[dennilfloss]

Heads up! When I came home just earlier, turned on radio, I heard them say some German guy came forth and said he wrote this bug BY MISTAKE! I AM NOT KIDDING!!!!!

I am now trying to find an account of this online. But It was on WINS News, NYC.
________________________________
Edit!

http://www.latimes.com/business/tec...ed-bug-20140410,0,2676251.story#axzz2ybVT8qGi

http://arstechnica.com/information-...xplains-openssl-mistake-that-put-web-at-risk/

 

[Virgorising]

http://arstechnica.com/information-...xplains-openssl-mistake-that-put-web-at-risk/

Exactly! I AM GOB SMACKED.

 

[IndyColtsFan]

Exactly! I AM GOB SMACKED.

I'm not sure why you think this is a huge revelation. You do know most software has bugs, right? And you do know that bugs generally aren't intentional, right? In this case, the guy made a simple mistake and the reviewer didn't catch it either.

 

[Virgorising]

I'm not sure why you think this is a huge revelation. You do know most software has bugs, right? And you do know that bugs generally aren't intentional, right? In this case, the guy made a simple mistake and the reviewer didn't catch it either.

I expressed my reactions actually. Nothing to apologize for. I am not as defensively chilled out and cynical and sanguine as you are, nor would I ever wanna be.

Especially, given most people assumed some malfeasance and purposeful chinanery were at play here.

 

[IndyColtsFan]

I expressed my reactions actually. Nothing to apologize for. I am not as defensively chilled out and cynical and sanguine as you are, nor would I ever wanna be.

I'm not asking you to apologize. I'm asking why you think that it is such a stunning revelation that someone made a mistake in the code. Coding mistakes happen all the time but unfortunately, this particular mistake has really bad consequences compared to most.

Especially, given most people assumed some malfeasance and purposeful chinanery were at play here.

They can remove their tinfoil hats now. It's safe.

 

[OutHouse]

lol so he made a minor change to fix a bug but made a bug and was missed by reviewing and testing resulting in all hell breaking loose.

i think he used to work at my company hahahah

 

[IndyColtsFan]

lol so he made a minor change to fix a bug but made a bug and was missed by reviewing and testing resulting in all hell breaking loose.

i think he used to work at my company hahahah

Microsoft?

 

[Virgorising]

I'm not asking you to apologize. I'm asking why you think that it is such a stunning revelation that someone made a mistake in the code. Coding mistakes happen all the time but unfortunately, this particular mistake has really bad consequences compared to most.

They can remove their tinfoil hats now. It's safe.

Bottom line, this event, its magnitude and impact both: unique in cyber history. End of story.

 

[Crusty]

Bottom line, this event, its magnitude and impact both: unique in cyber history. End of story.

I still don't get why you're so surprised.

Programmers are human, and humans make mistakes...

 

[Virgorising]

lol so he made a minor change to fix a bug but made a bug and was missed by reviewing and testing resulting in all hell breaking loose.

i think he used to work at my company hahahah

Yes, it's

 

[Markbnj]

Exactly! I AM GOB SMACKED.

Here's another one:

http://www.theverge.com/2014/4/11/5604300/heartbleed-may-not-leak-private-ssl-keys-after-all

Cloudflare has a honeypot out there right now and has invited people to try and get the ssl keys from it. We'll see what happens.

 

[Virgorising]

I still don't get why you're so surprised.

Programmers are human, and humans make mistakes...

Let me try again, never before to my knowledge has some MISTAKE of this sort, impacted as many in the world as THIS ONE.

No professional gets it right all the time. This is about worldwide IMPACT. In that, this event, so far....is UNIQUE.

 

[Virgorising]

Microsoft?

Now that......was cute.

 

[Virgorising]

Here's another one:

http://www.theverge.com/2014/4/11/5604300/heartbleed-may-not-leak-private-ssl-keys-after-all

Cloudflare has a honeypot out there right now and has invited people to try and get the ssl keys from it. We'll see what happens.

Thank U. That is my fav link so far.

 

[Virgorising]

I know people know, but this is just now the lead story on Huffington:

http://www.bloomberg.com/news/2014-...e-used-heartbleed-bug-exposing-consumers.html

Talk about insidious.

 

[Virgorising]

Just found this from yesterday, the 10th:

http://www.huffingtonpost.com/2014/04/10/heartbleed-computer-bug_n_5129848.html?ir=Technology

OMG. And the jury is still out re the reality of the actual threats this has created.

 

[tfinch2]

http://blog.cloudflare.com/answerin...can-you-get-private-ssl-keys-using-heartbleed

 

[Virgorising]

http://blog.cloudflare.com/answerin...can-you-get-private-ssl-keys-using-heartbleed

K....so, private keys are not at risk?

At Least they can't use the thing to compromise them?

 

[Lean L]

K....so, private keys are not at risk?

At Least they can't use the thing to compromise them?

That is one of the best articles posted about the issue in this thread and answers your question perfectly. Just read the thing.

In short, it's possible but rare (Their case study was NGINX) since the private key would not be as likely to stay in memory after SSL is initialized. It's rare to find that piece of information to begin with due to the random data that is retrieved anyways.

But seriously... READ that article.

 

[Virgorising]

That is one of the best articles posted about the issue in this thread and answers your question perfectly. Just read the thing.

In short, it's possible but rare (Their case study was NGINX) since the private key would not be as likely to stay in memory after SSL is initialized. It's rare to find that piece of information to begin with due to the random data that is retrieved anyways.

But seriously... READ that article.

I did read it. Truth is, I am so creeped out, I could not totally believe it.

 

[CZroe]

K....so, private keys are not at risk?

At Least they can't use the thing to compromise them?

Sure they are. They are extremely difficult to access after the first request due to the contents of the memory being unpredictable, but it's possible. Heck, there are DoS attacks/exploits that could be used to force a reboot for a first request. Someone try sending that honeypot the ol', Win95 Ping of Death.