A highly critical vulnerability in the OpenSSL library which allows an attacker to obtain random 64kByte blocks of memory from the process using said library, which could include user credentials, private SSL keys, and other data sent/received from the server.

learn more… | top users | synonyms

7
votes
2answers
952 views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug?

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
2
votes
1answer
120 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
0
votes
1answer
57 views

How to check if Android application is vulnerable to heartbleed

I Am trying to find if an android application is vulnerable to heartbleed vulnerability. I want to know how to check if the application is vulnerable to heartbleed by reversing the app file.
2
votes
2answers
181 views

One year later, is Heartbleed still something the end-user needs to be careful against?

I'm running Chromebleed to defend against sites affected by Heartbleed, but it's been a very long time since I've used a site that was still vulnerable. By now I would think the vast majority of the ...
2
votes
4answers
4k views

Is TLS 1.0 more secure than TLS 1.2?

I just wanted to confirm, my system admin is telling me that TLS 1.0 is more secure than TLS 1.2 and told me I should stay on TLS 1.0...is this accurate? He mentioned that TLS 1.2 is more vulnerable ...
3
votes
1answer
66 views

Heartbleed: length of heatbeat message?

What is the right length of heartbeat message between 2^14 and 2^16 ? The RFC https://tools.ietf.org/html/rfc6520 says that The total length of a HeartbeatMessage MUST NOT exceed 2^14 or ...
-6
votes
1answer
165 views

Tls vs SSl heartbleed [closed]

I serched in the web for some more details and didn't find anything useful. May heartbleed attack be applied on the ssl protocol ? If not , why it hasnt the same security hole for heastbleed aa the ...
1
vote
1answer
49 views

Will changing the 'Action' for Heartbleed signatures in PAN from 'alert' to 'drop' have any production impact in my organization?

I have been seeing some Heart-bleed PAN alerts. I want to set the default action from 'alert' to 'drop'. But I am not sure if this would block some legitimate packets. Since there are a vast number ...
0
votes
0answers
45 views

Heartbleed Check (OpenVPN Support)

I'm searching for a Heartbleed Checker with OpenVPN/UDP Support. All the Heartbleed Tools support only TCP, but not UDP. Is there any variant with UDP Support?
2
votes
2answers
307 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
-6
votes
1answer
216 views

How does Heartbleed exploit work? [duplicate]

I was wondering, what it means in the Heartbleed exploit. Let me explain. I'm trying to understand what does "hello" and "heartbeat" mean. Example: hello = h2bin("16 03 02 00 dc 01 00 00 d8 03 02 53 ...
2
votes
2answers
2k views

Is OpenSSL CCS Injection (CVE-2014-0224) critical?

Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. It allows man-in-the-middle attackers to consequently hijack sessions ...
0
votes
2answers
633 views

Heartbleed check for mobile and mobile apps

I have run a heartbleed detector from Lookout on my Android phone. It says: The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled. What does it ...
0
votes
2answers
212 views

Heartbleed: revoke or replace ssl certificate?

I have a free ssl certificate issued just before Heartbleed was found. Now my CA wants me to pay 25$ to revoke it. Should I pay or it's just enough to create a new certificate from another CA an ...
-3
votes
3answers
91 views

what is remedy for the heartbleed bug? [duplicate]

I found lot of articles describing about the heard bleed bug but can someone please explain the remedy for the heart bleed bug ?
1
vote
1answer
169 views

How to avoid Heartbleed like problems in the future?

I asked a question on stackoverflow, but guess this site is better suited for it. Idea is to prevent problems when the next buffer overflow bug comes out. In my understanding the problem with ...
0
votes
2answers
535 views

Is there a HeartBleed Honeypot so that I can pentest it? [closed]

I am looking to improve my skills, to do so I need a site with an old OpenSSL version, so that I can do a pentest on my own.
12
votes
2answers
2k views

Do any OpenBSD protections mitigate the damage from Heartbleed?

OpenBSD provides a list of substantial protections against exploits inherent to the OS. Most of these features are not found in other operating systems, or at least are not turned on by default. The ...
2
votes
1answer
296 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
-2
votes
1answer
60 views

Whether heartbleed is attaked while we are using heartbeat with apache(httpd)? [closed]

We are using heartbeat for high availability of httpd. In httpd we are using openssl of version 0.9.8 but about heartbeat i dont much about that but while search in google some sites are sayong that ...
1
vote
0answers
762 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
4
votes
1answer
260 views

HeartBleed and Closed Source Hardware like Cisco

With the release of heartbleed how does one protect themselves with closed source networking hardware like cisco? Especially hardware with VPN variety. Would it be best to replaced such systems with ...
0
votes
1answer
245 views

Python SSH vs SSL? [duplicate]

I read the What is the difference between SSL vs SSH? Which is more secure? , and it mentions there is the possibility they can be affected by similar attacks. Now that the heartbleed thing is out, ...
4
votes
2answers
258 views

Can Heartbleed expose a TOR user's IP address?

It is interesting to observe, that TOR exit nodes with out-of-date OpenSSL implementations can themselves be affected by the Heartbleed bug. Can Heartbleed expose a TOR user's IP address merely by ...
2
votes
2answers
371 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
0
votes
1answer
58 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
7
votes
1answer
356 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
1
vote
1answer
2k views

Explain the Heartbleed Python code [closed]

first post here so be gentle please! I understand the Heartbleed vulnerability concept, and I have a general grasp of Python. I'm struggling to understand the PoC Python code though, so was after a ...
1
vote
3answers
109 views

Multi-tenancy and Heartbleed

We use a well-known service provider/API management gateway that sits in front of our RESTful APIs providing key management functionality etc. etc. The service provider was running the dodgy OpenSSL ...
1
vote
2answers
176 views

Testing your site for the heartbleed vulnerability? [duplicate]

I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here: ...
1
vote
2answers
835 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
4
votes
2answers
465 views

Is crypto.js vulnerable to heartbleed attack? [duplicate]

We are using 'crypto.js' in our application. Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack? If yes, what can we do to prevent it?
1
vote
2answers
1k views

What can a hacker do to my home router if I have the admin page enabled externally? [duplicate]

Say my home router uses an OpenSSL version that is vulnerable to Heartbleed and I have the admin page enabled and accessible from the outside (even though I never use it). What can a hacker do? ...
1
vote
1answer
441 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
9
votes
1answer
1k views

Who proposed adding heartbeat to SSL? And who proposed it's form?

So we now know who wrote the bad code (Robin Seggelmann). And we have an idea of why it is needed: Why does TLS need an explicit heartbeat protocol? We can also understand why the client supplies ...
1
vote
0answers
63 views

Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]

I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following. Situation A If I would use a regular SSL/TLS connection the handshake will ...
2
votes
1answer
228 views

Heartbleed: hackers have already used the vulnerability? [duplicate]

Read about the vulnerability and decided to check out the site. Receiving a response from the php code was surprised. Look at the screenshot. Perl-script: http://pastebin.com/rL0XkewP Hackers ...
60
votes
3answers
6k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
3
votes
2answers
295 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
0
votes
3answers
161 views

When given a SSL-Private-Key, how would one generate a valid SSL-Cert from this? [duplicate]

in the hybris of leaked ssl-private-key everybody cries for new certs and new keys. my question: how would one generate a new and valid ssl-cert with the private key from my website? our certs are ...
0
votes
1answer
92 views

Will the recently found OpenSSL vulnerability Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
1
vote
1answer
256 views

I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? [duplicate]

According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not. I use my Google ID to logon to Stack Overflow (and some other sites). Do I need to change my password? In ...
2
votes
1answer
151 views

Ethicality of websites that test other sites for Heartbleed [closed]

I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in. I was reading a BBC article about Heartbleed, and in the ...
0
votes
1answer
50 views

problem upgrading openssl on ubuntu servers [closed]

I'm running Ubuntu x86_64, and want to upgrade to OpenSSL 1.0.1.f. wget <openssl latest> tar -xzvf openssl.tar.gz cd <openssl dir> ./configure --prefix=/usr make In the console output, ...
26
votes
3answers
2k views

How can an attacker use a leaked private key?

I admit that while I'm a programmer, my crypto/security knowledge is fairly basic. I understand that the potential of leaking private SSL keys is cited as one of the most serious effects of the ...
9
votes
1answer
3k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...
2
votes
1answer
511 views

How to verify OpenSSL's Heartbleed patch is the correct one?

In hearing about the Heartbleed vulnerability, I went to https://www.openssl.org/source/ to download the latest patch, but was quite surprised to find that the security certificate for that site has ...
4
votes
1answer
280 views

Defending against private key leaks such as those enabled by Heartbleed

More and more evidence seems to be surfacing that the Heartbleed vulnerability leaks the private key portion of the SSL certificate in use. As such this can actually mean that if an attacker was also ...
2
votes
1answer
141 views

HeartBleed ReKeyed Cert with old creation date

the lastpass.com/heartbleed tool states that my server is most likely vulnerable and that users should wait untill my cert has been replaced. It seems that they check for certificate creation date, ...
0
votes
2answers
501 views

How can I confirm that my server is protected against HeartBleed? [duplicate]

I just got a software update openssl-1.0.1e-37. I believe it is a patch for HeartBleed. Given that it was widely reported that versions up to 1.0.1f are vulnerable, how can I verify this patch on my ...