A highly critical vulnerability in the OpenSSL library which allows an attacker to obtain random 64kByte blocks of memory from the process using said library, which could include user credentials, private SSL keys, and other data sent/received from the server.

learn more… | top users | synonyms

1
vote
1answer
43 views

Private key and wildcard certificates

I'm trying to understand the implications of private key leakage (due to Heartbleed) from a website that uses a wildcard certificate. If an organization has a wildcard certificate (valid for *.domain....
1
vote
2answers
161 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
0
votes
1answer
77 views

Detecting heartbleed without sending a heartbeat packet (Heartbleed specific)

I am trying to detect if a server is vulnerable to heartbleed. To do this, only idea i have is to actually send a heartbeat packet having length field and actual payload having different length. But ...
0
votes
1answer
52 views

Event: ET SCAN Nmap NSE Heartbleed Request

Last night I got this incident on my siem tool: Event: ET SCAN Nmap NSE Heartbleed Request. Incident triggered from blacklisted IP to our open VPN server. Clicking on the signature content it ...
2
votes
1answer
61 views

Heartbleed RSA Key

I'm currently a student doing some research into the Heartbleed Vulnerability and I'm having difficulty retrieving the correct RSA private keys. Here is my setup environment in VirtualBox: Kali ...
5
votes
3answers
169 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
2
votes
1answer
313 views

Why is this version of OpenSSL (1.0.1e) not vulnerable to Heartbleed?

I recently ran into a requirement that needed a web server set up with SSL, to show that its possible to extract the private key from a server with a vulnerable version of OpenSSL (Heartbleed). Hence, ...
7
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [closed]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
3
votes
1answer
149 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
0
votes
1answer
121 views

How to check if Android application is vulnerable to heartbleed

I Am trying to find if an android application is vulnerable to heartbleed vulnerability. I want to know how to check if the application is vulnerable to heartbleed by reversing the app file.
2
votes
2answers
204 views

One year later, is Heartbleed still something the end-user needs to be careful against?

I'm running Chromebleed to defend against sites affected by Heartbleed, but it's been a very long time since I've used a site that was still vulnerable. By now I would think the vast majority of the ...
8
votes
4answers
23k views

Is TLS 1.0 more secure than TLS 1.2?

I just wanted to confirm, my system admin is telling me that TLS 1.0 is more secure than TLS 1.2 and told me I should stay on TLS 1.0...is this accurate? He mentioned that TLS 1.2 is more vulnerable ...
3
votes
1answer
96 views

Heartbleed: length of heatbeat message?

What is the right length of heartbeat message between 2^14 and 2^16 ? The RFC https://tools.ietf.org/html/rfc6520 says that The total length of a HeartbeatMessage MUST NOT exceed 2^14 or ...
-6
votes
1answer
367 views

Tls vs SSl heartbleed [closed]

I serched in the web for some more details and didn't find anything useful. May heartbleed attack be applied on the ssl protocol ? If not , why it hasnt the same security hole for heastbleed aa the ...
1
vote
1answer
55 views

Will changing the 'Action' for Heartbleed signatures in PAN from 'alert' to 'drop' have any production impact in my organization?

I have been seeing some Heart-bleed PAN alerts. I want to set the default action from 'alert' to 'drop'. But I am not sure if this would block some legitimate packets. Since there are a vast number ...
1
vote
2answers
374 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
-6
votes
1answer
312 views

How does the Heartbleed exploit work? [duplicate]

I was wondering, what it means in the Heartbleed exploit. Let me explain. I'm trying to understand what does "hello" and "heartbeat" mean. Example: hello = h2bin("16 03 02 00 dc 01 00 00 d8 03 02 53 ...
2
votes
2answers
2k views

Is OpenSSL CCS Injection (CVE-2014-0224) critical?

Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. It allows man-in-the-middle attackers to consequently hijack sessions ...
0
votes
2answers
880 views

Heartbleed check for mobile and mobile apps

I have run a heartbleed detector from Lookout on my Android phone. It says: The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled. What does it ...
0
votes
2answers
254 views

Heartbleed: revoke or replace ssl certificate?

I have a free ssl certificate issued just before Heartbleed was found. Now my CA wants me to pay 25$ to revoke it. Should I pay or it's just enough to create a new certificate from another CA an ...
-3
votes
3answers
107 views

what is remedy for the heartbleed bug? [duplicate]

I found lot of articles describing about the heard bleed bug but can someone please explain the remedy for the heart bleed bug ?
1
vote
1answer
200 views

How to avoid Heartbleed like problems in the future?

I asked a question on stackoverflow, but guess this site is better suited for it. Idea is to prevent problems when the next buffer overflow bug comes out. In my understanding the problem with ...
0
votes
2answers
618 views

Is there a HeartBleed Honeypot so that I can pentest it? [closed]

I am looking to improve my skills, to do so I need a site with an old OpenSSL version, so that I can do a pentest on my own.
12
votes
2answers
2k views

Do any OpenBSD protections mitigate the damage from Heartbleed?

OpenBSD provides a list of substantial protections against exploits inherent to the OS. Most of these features are not found in other operating systems, or at least are not turned on by default. The ...
2
votes
1answer
313 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
-2
votes
1answer
62 views

Whether heartbleed is attaked while we are using heartbeat with apache(httpd)? [closed]

We are using heartbeat for high availability of httpd. In httpd we are using openssl of version 0.9.8 but about heartbeat i dont much about that but while search in google some sites are sayong that ...
0
votes
0answers
958 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
5
votes
1answer
269 views

HeartBleed and Closed Source Hardware like Cisco

With the release of heartbleed how does one protect themselves with closed source networking hardware like cisco? Especially hardware with VPN variety. Would it be best to replaced such systems with ...
0
votes
1answer
334 views

Python SSH vs SSL? [duplicate]

I read the What is the difference between SSL vs SSH? Which is more secure? , and it mentions there is the possibility they can be affected by similar attacks. Now that the heartbleed thing is out, ...
4
votes
2answers
280 views

Can Heartbleed expose a TOR user's IP address?

It is interesting to observe, that TOR exit nodes with out-of-date OpenSSL implementations can themselves be affected by the Heartbleed bug. Can Heartbleed expose a TOR user's IP address merely by ...
2
votes
2answers
452 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
0
votes
1answer
58 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
8
votes
1answer
495 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
1
vote
1answer
2k views

Explain the Heartbleed Python code [closed]

first post here so be gentle please! I understand the Heartbleed vulnerability concept, and I have a general grasp of Python. I'm struggling to understand the PoC Python code though, so was after a ...
1
vote
3answers
119 views

Multi-tenancy and Heartbleed

We use a well-known service provider/API management gateway that sits in front of our RESTful APIs providing key management functionality etc. etc. The service provider was running the dodgy OpenSSL ...
1
vote
2answers
186 views

Testing your site for the heartbleed vulnerability? [duplicate]

I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here: https://filippo....
1
vote
2answers
1k views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
5
votes
2answers
582 views

Is crypto.js vulnerable to heartbleed attack? [duplicate]

We are using 'crypto.js' in our application. Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack? If yes, what can we do to prevent it?
1
vote
2answers
1k views

What can a hacker do to my home router if I have the admin page enabled externally? [duplicate]

Say my home router uses an OpenSSL version that is vulnerable to Heartbleed and I have the admin page enabled and accessible from the outside (even though I never use it). What can a hacker do? ...
1
vote
1answer
458 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
9
votes
1answer
1k views

Who proposed adding heartbeat to SSL? And who proposed it's form?

So we now know who wrote the bad code (Robin Seggelmann). And we have an idea of why it is needed: Why does TLS need an explicit heartbeat protocol? We can also understand why the client supplies ...
1
vote
0answers
66 views

Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]

I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following. Situation A If I would use a regular SSL/TLS connection the handshake will ...
2
votes
1answer
240 views

Heartbleed: hackers have already used the vulnerability? [duplicate]

Read about the vulnerability and decided to check out the site. Receiving a response from the php code was surprised. Look at the screenshot. Perl-script: http://pastebin.com/rL0XkewP Hackers ...
62
votes
3answers
7k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
4
votes
2answers
349 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
0
votes
3answers
172 views

When given a SSL-Private-Key, how would one generate a valid SSL-Cert from this? [duplicate]

in the hybris of leaked ssl-private-key everybody cries for new certs and new keys. my question: how would one generate a new and valid ssl-cert with the private key from my website? our certs are ...
0
votes
1answer
94 views

Will the recently found OpenSSL vulnerability Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
1
vote
1answer
265 views

I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? [duplicate]

According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not. I use my Google ID to logon to Stack Overflow (and some other sites). Do I need to change my password? In ...
2
votes
1answer
162 views

Ethicality of websites that test other sites for Heartbleed [closed]

I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in. I was reading a BBC article about Heartbleed, and in the ...
0
votes
1answer
53 views

problem upgrading openssl on ubuntu servers [closed]

I'm running Ubuntu x86_64, and want to upgrade to OpenSSL 1.0.1.f. wget <openssl latest> tar -xzvf openssl.tar.gz cd <openssl dir> ./configure --prefix=/usr make In the console output, ...