Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I admit that while I'm a programmer, my crypto/security knowledge is fairly basic. I understand that the potential of leaking private SSL keys is cited as one of the most serious effects of the Heartbleed bug. My question is, how can an attacker actually use the private key?

Heartbleed.com states that:

These are the crown jewels, the encryption keys themselves. Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will.

"Decrypt any past and future traffic" is clear to me, assuming the attacker has (or has had) means of sniffing the encrypted traffic. But I can't quite grasp how they can "impersonate the service at will."

The way I understand it, to impersonate the service, the attacker would need a way to divert traffic to their site, or pose as a man in the middle. And I believe both of these are quite difficult to accomplish (at least when no unsecure network like public Wi-Fi is involved). Is this correct, or am I missing something?

So, perhaps a different way to phrase it: if I, as an end user, type in https://someorotherdomain.tld into a browser's address bar (and there's no certificate problem), how likely am I to be talking to someone else due to someorotherdomain's private key having been heartbled?

share|improve this question
4  
"Decrypt any past and future traffic" assumes the same private key, and no use of PFS. –  Steel City Hacker Apr 11 at 13:28
    
@SteelCityHacker, Doesn't "assume the same private key" and "no use of PFS" mean the same thing? –  Pacerier Apr 11 at 15:46

3 Answers 3

up vote 9 down vote accepted

So, perhaps a different way to phrase it: if I, as an end user, type in https://someorotherdomain.tld into a browser's address bar (and there's no certificate problem), how likely am I to be talking to someone else due to someorotherdomain's private key having been heartbled?

You rightfully ask how likely, which does not demand a clear answer but rather a probability. What factors do affect the likelihood?

  • How many gateways are between you and the destination;
  • How many of these can control your DNS queries too;
  • What's the bounty? Or, given the cost of mounting a MITM attack, what are the possible rewards? Which is linked to:
  • How juicy is the target? (e.g. spoofing gmail.com in a public wi-fi in an airport)
  • Which country are you in? Maybe the government wants to know if you're planning to overthrow them. Or they just spy on everyone, all the time, by default.

These should give you a quick back-of-the-envelope calculations on the likelihood of this happening to you personally.

share|improve this answer
5  
Somewhat extending the "control your DNS queries" point: There are also attacks like DNS cache poisoning. Or just send a good old fax to a low-end registrar and have them change authorative DNS servers for that domain. Many other attacks can be chained with that one. –  PlasmaHH Apr 11 at 14:15

Here is an example: My dad started getting browser certificate warnings when he went to Gmail. I looked in his hosts (C:\Windows\System32\drivers\etc\hosts ) file and some malware had edited it to redirect requests to gmail and a bunch of other sites to bad IP addresses that I assume the attacker controlled. His browser warned him because those bad IP addresses did not have the correct private key of the certificate. Now, if they had used a heartbleed type attack to grab those private keys, they could better impersonate the sites and my dad would have never seen a warning.

share|improve this answer
1  
What's the linux equivalent? –  Pacerier Apr 11 at 15:47
7  
On Linux: /etc/hosts –  mcgyver5 Apr 11 at 16:04
    
Couldn't the potential attacker add his own self-signed certificates, so the browser wouldn't complain about this? –  xfix Apr 12 at 17:13
1  
@Yogu: The browsers complain, all-right, but only if the certificate is not recognized. If the certificate is in system's database of certificates, it's fine. –  xfix Apr 12 at 20:43
1  
@xfix Ah, you're right - the attacker must have root access to modify /etc/hosts, so it can basically do anything. –  Yogu Apr 12 at 22:26

Within a cooperate environment the attacker could have been sniffing from a network switch however that network may employ anti-arp spoofing prevent the attacker from using tools such as SSL strip.. However now the attacker holds the encryption keys he would be able to decrypt all the traffic he had gathered previously.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.