Tag Info

Hot answers tagged

62

There is more to consider than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just supersceded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that ...


20

Directly copied from OpenSSL site OpenSSL Security Advisory [07 Apr 2014] TLS heartbeat read overrun (CVE-2014-0160) A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. ...


12

Well there's a couple of potential attack vectors which could be relevant. First up ports. Surprsingly some ATMs do indeed have USB ports and have been attacked via them (more info here as an example and also this CCC presentation on infecting ATMs with malware). However you'd hope that ATMs have decent physical security to help mitigate that class of ...


9

Personally I don't think that the support end of Windows XP, is such a great deal for embedded systems like ATMs. I gave a quite detailed answer to this here. It definitely matters for the consumer market, though. In regards to your question on how these things might get exploited, refer to this blog entry for a few examples from the past. I think you are ...


9

[edited] I made a tool to check the status of your SSL and see if heartbeat is enabled and vulnerable. Tool at: http://rehmann.co/projects/heartbeat/ There's another one at http://filippo.io/Heartbleed/ If you're vulnerable, please upgrade your OpenSSL packages & renew your certs!


7

Modern OSes use virtual memory spaces for each process that leads to process isolation. So it is impossible for a webserver using the flawed OpenSSL library to read memory allocated to other processes (not explicitly shared with the process), at best attempts to do so would result in a segmentation fault. The truth is heartbleed is a simple overread of a ...


3

Note that if you're using a cloud based provider or content distribution network, and they are vulnerable, your website's leaking content will be mixed with content of all other websites using this provider. I've just just seen that with Incapsula, where a bank website's content was leaked along cryptocurrency website. They're fixed now fortunately.


3

Jspenguin wrote an offline tool to check if a server has the flaw. Download it, audit it, and run it. I also wrote ssl-heartbleed-check.pl (also an offline tool) to check if the OpenSSL used by your Perl stack (which on *n*x is often the openssl used by the whole system) is affected. This can help you to determine if you are affected on the client side. ...


3

Obviously allowing users to upload any file types is very dangerous Anything a user uploads is just 0s and 1s until you actually decide to do something with it. Executing such files would be a bad idea, yes. Executable programs don't automatically run unless you tell them to, though. If you are wondering about the autorun behavior of certain storage ...


3

...because what's going on is that you're compromising your own system. If you read the Old/New Thing blog, the author calls it "being on the other side of an airtight hatchway". It's like asking what's preventing people from entering your house - all your friends would ask "yes, but you lock your doors, don't you?"; you can "break into" your own house ...


2

Since I use php as an Apache module instead of CGI, and the http code was 404, I think nothing bad happened, right? right What was the attacker trying to do (or, if he was successful, what did he do) to my system? it was probably the first stage in a multi-stage-attacke(script); this is just the first scan, if you system is vulnerable or not.


2

The end of support for XP is not that big a concern for ATM security as it is the lack of overall support for the operating system. Right now when an ATM manufacturer runs into an issue with XP they cannot resolve they can call the vendor and get assistance, once XP is end of life Microsoft can simply refuse that help. ATM manufacturers looking to bring in ...


2

From what I understand, it's the luck of the draw. You may get sensitive information or nothing at all. It all depends what happens to reside in the memory the exploit is pushing out to you. This can include private keys as the server process will cache this for quick access during SSL transmissions, but from my limited testing I was able to fetch HTTP ...


1

You can do this a few different ways. First, if your exploit is an EXE-dropping exploit (like psexec), you can set the EXE::Custom advanced option. Otherwise you can use one of the payloads that allows you to upload (windows/upexec/*) or download (windows/download_exec) a custom executable.


1

No - it does not mean you are not vulnerable. The patches you have installed may have fixed the particular vulnerability, but failure of a test does not automatically mean you are safe - it could just be the case that your test version is misconfigured, failed due to a local configuration or bug, or has had some other problem. The usual way to gain ...


1

Step back from the details and look at the larger question: Can a computer program that accepts inputs be exploited? The answer to that question is always yes. Always always always. It doesn't mean it will happen and it doesn't mean it would be easy but the potential for exploitation exists. Even an extremely simple program written in a very ...


1

Return address encryption prevents ROP gadgets from being used because the attacker won't be able to predict the value of the key, so the attacker won't know what to write on the stack to cause the return instruction at the end of one gadget to transfer control to the next gadget. Remember how ROP attacks work. The attack involves executing a sequence of ...



Only top voted, non community-wiki answers of a minimum length are eligible