Heartbleed bug

[GO-NAD!]

Anyone here concerned about this? I'm not really geeky enough to fully grasp the implications, but if this has been an issue for a couple of years, could it really be that bad?

 

[TLS Guy]

Anyone here concerned about this? I'm not really geeky enough to fully grasp the implications, but if this has been an issue for a couple of years, could it really be that bad?

It probably is. Time to go back to the quill and ink!

 

[BoredSysAdmin]

Anyone here concerned about this? I'm not really geeky enough to fully grasp the implications, but if this has been an issue for a couple of years, could it really be that bad?

It's worse than bad, much much worse. If anyone here is running a website or a portion of website protected by SSL (https://www.xxxxxxxxxxx.xxx/)
Same thing for SFTP sites, SSH remote access etc...

If you don't know any of these terms - you probably have nothing to worry about, except of-course using above mentioned protocols and tools and worrying about your personal data leaking.

Tell your IT people to patch the systems ASAP

 

[jinjuku]

Yes it is bad. Tuesday we patched all our Linux boxes.

Even if you don't understand what the terms mean, trust me, you are using those technologies.

 

[fuzz092888]

From what I've read it sounds pretty bad. Any company that uses SSL encryption could have had data stolen from it without zero traces. Check your bank accounts regularly

 

[Steve81]

From what I've read it sounds pretty bad. Any company that uses SSL encryption could have had data stolen from it without zero traces. Check your bank accounts regularly

Isn't it a vulnerability in OpenSSL (one variant, as opposed to all SSL/TLS implementations)?

 

[Adam]

There's a whole slew of things out there that are "bad." There's always something that could be a problem. Some we find, most we don't. Some are related to cyber security, some to health, and so on. Could this make my life worse? Yes. But, so can a lot of other things. Because I'm not responsible for websites that use this, I'm not going to worry about it. If someone drains my bank account, odds are they're going to do the same to a lot of other people, and I have paper statements showing my balances.

 

[GO-NAD!]

Yes it is bad. Tuesday we patched all our Linux boxes.

Even if you don't understand what the terms mean, trust me, you are using those technologies.

I have a basic grasp of what it means and I realize that SSL is used practically everywhere, but if this has been a problem for a couple of years, you would think that someone would have been able to take advantage of it by now. If someone has been exploiting it, they've been very crafty about it. Otherwise, wouldn't we be hearing reports of breaches of secure sites that couldn't be explained?

 

[BoredSysAdmin]

Isn't it a vulnerability in OpenSSL (one variant, as opposed to all SSL/TLS implementations)?

Yes, but it's like saying it's an issue with fuel combustion engine (one variant, as opposed to all types of engines)

Most of internet is built on lamp - probably around 70% and vast majority of these sites use openssl to implement secure access then needed.

 

[Steve81]

Yes, but it's like saying it's an issue with fuel combustion engine (one variant, as opposed to all types of engines)

Most of internet is built on lamp - probably around 70% and vast majority of these sites use openssl to implement secure access then needed.

Not to underplay the issue, but there's still a significant difference between saying "most websites" and "all websites" will be impacted. It's nice to know my Outlook.com account won't be impacted for example.

 

[BoredSysAdmin]

Not to underplay the issue, but there's still a significant difference between saying "most websites" and "all websites" will be impacted. It's nice to know my Outlook.com account won't be impacted for example.

Biggest sites I believe were updated quite rapidly (yesterday) , but there are still hundreds of thousands which were not

 

[jliedeka]

Not every site that uses SSL, even using OpenSSL is vulnerable. The stats I saw showed the minority using the SSL heartbeat feature. The ones that didn't enable it aren't vulnerable. SSH is not affected.

Apparently the issue is in OpenSSL's wrapper code around malloc and free. It allowed reading past the end of a buffer. Theo DeRaadt, the maintainer of OpenBSD had some choice words about OpenSSL's design.

Jim

 

[jinjuku]

How does the end user know if the SSL encrypted website they are using uses that method?

I'm just happy I use a password manager. Different, long, with unique character passwords thank you very much.

 

[BoredSysAdmin]

How does the end user know if the SSL encrypted website they are using uses that method?

I'm just happy I use a password manager. Different, long, with unique character passwords thank you very much.

you could test the site for heartbleed here:
Test your server for Heartbleed (CVE-2014-0160)

 

[BoredSysAdmin]

And more details:
Bleeding Heart OpenSSL Vulnerability | Fort Pedro
‘Heartbleed’ Bug Exposes Passwords, Web Site Encryption Keys — Krebs on Security

 

[jinjuku]

I know about the utility. But what I am saying is we are in the know. How is Joe User going to know.

 

[3db]

I'm chiming in now. First off, I don't know why they call it a bug. Its not a bug as in malware. Its simply a security hole with GNU based OpenSSL. Solaris/Oracle branded openssl is safe. Secondly, you would need to be a mathematician to take advantage of this security hole in reconstructing memory segments that is available for viewing in this hole. The problem lies with the media and its sensationalism and bottom line of making money instead of accurately reporting what constitutes news. This is far too overhyped.

 

[3db]

And more details:
Bleeding Heart OpenSSL Vulnerability | Fort Pedro
‘Heartbleed’ Bug Exposes Passwords, Web Site Encryption Keys — Krebs on Security

Its not a bug..

 

[BoredSysAdmin]

I'm chiming in now. First off, I don't know why they call it a bug. Its not a bug as in malware. Its simply a security hole with GNU based OpenSSL. Solaris/Oracle branded openssl is safe. Secondly, you would need to be a mathematician to take advantage of this security hole in reconstructing memory segments that is available for viewing in this hole. The problem lies with the media and its sensationalism and bottom line of making money instead of accurately reporting what constitutes news. This is far too overhyped.

One does indeed have to be a very smart folk to find at the first place, but the problem is one does not have to too bright to use since proof of concept code become available.
Even the slightest (smaller than winning megaball lottery) change of leaking private keys is HUGE issue by itself.
Again it's not Solaris or BSD servers which power huge portion of the internet, but specifically gnu based distros which used gnu based OpenSSL. The saving grace is not everyone (minority) had heartbeat feature turned on.

 

[BoredSysAdmin]

Its not a bug..

Yes it is.
Security issue in the code is definitely a code bug. No bug as in malware, but as in issue in the programming.
And this is not "over-hyped" enough.