Tag Info

New answers tagged

0

Secunia also makes a glorious little package called Secunia PSI which alerts you when there are patches available for the software installed on your computer. PSI is for personal use, and is free. For non-windows devices, obviously subscribing to the relevant CERT list is a good idea. The problem I have with CERT lists is that they don't report on the ...


0

Is there a way to determine as an end-user which HTTPS sites use OpenSSL? only website administrator can tell this info. From outside SSL version info can be retrived. Due to heartbleed it is recommended that clients change their passwords that were sent over TLS recently as private keys may have ...


7

Modern OSes use virtual memory spaces for each process that leads to process isolation. So it is impossible for a webserver using the flawed OpenSSL library to read memory allocated to other processes (not explicitly shared with the process), at best attempts to do so would result in a segmentation fault. The truth is heartbleed is a simple overread of a ...


2

From what I understand, it's the luck of the draw. You may get sensitive information or nothing at all. It all depends what happens to reside in the memory the exploit is pushing out to you. This can include private keys as the server process will cache this for quick access during SSL transmissions, but from my limited testing I was able to fetch HTTP ...


2

You can subscribe to the US-CERT maillist It provides a variety of products. Covers mainly below four topics: Alerts - timely information about current security issues, vulnerabilities, and exploits Bulletins — weekly summaries of new vulnerabilities. Patch information is provided when available Tips - advice about common security issues for the general ...


0

exploit-db by offensive security is pretty good. I don't really know of any other places that list exploits or email exploits. They also have a twitter feed that updates when they post new exploits; Their might be others that i'm not aware of.


4

As an end user, not easily, unless an attacker brags about it or a site owner discovers it, you can't tell what's actually been lost. For the technically adept, anyone (end user or site operator) running Snort or another IDS/IPS can look for indicators of realtime compromise in Snort rule form, as the attack can go both ways (your client can be attacked, ...


3

Well, for the purely malicious, those tend to be secret until the results are leaked. For an attack that actually found someone's password, there is this Twitter example of a Yahoo.com user's login name and password from Mark Loman, which is pretty clear that at least 1 user's login credentials have been seen by someone using Heartbleed.


1

Security advisories are normally posted by the project maintainers. In the case of Heartbleed, that would be the OpenSSL team. You should subscribe to the Project Announcements mailing list at https://www.openssl.org/support/community.html. This OpenSSL mailing list (linked to above) will only address security vulnerabilities (and project releases) ...


2

There's several proof of concept examples out there, and researchers have been able to use these to steal private keys and user login credentials, among other things. I have come across a blog post detailing how to use a python script to automate fetching user session information from a vulnerable server. I have also heard people were able to steal Yahoo ...


3

What you can do is to check if a website is vulnerable using the following online tool: http://filippo.io/Heartbleed If it is, you might want to change your password for that site, whether or not the owner contacted you to do so. However, to answer the last part of your question, no it is not possible to tell if a specific website has been compromised or ...


0

the article is ... well ... i wouldnt buy anything from a company with such a low level of knowlegde. How do I know that I'm vulnerable or not? answer in the blog: "We haven’t identified the initial attack vector. " my guess: infected admin-workstations sniffed ftp-passwords (yes, even in 2014) outdated plesk/cpanel - installations outdated ...


0

As far as I can tell, there isn't enough public information to know which systems are vulnerable. The Cisco blog you linked to appears to be the primary source for this news (other sites have since picked it up, but add nothing), and it does have any concrete information on the infection vector. The Cisco blog now includes the following edit (emphasis ...


3

A perfect block cipher is modeled as a pseudorandom permutation. For blocks of n bits, there are 2n! possible permutations; a perfect block cipher is as if the key was a random uniform selection of one permutation among all these. For a PRP, knowing many plaintext/ciphertext pairs (m, E(m)) gives you exactly zero information on the encryption of blocks m' ...



Top 50 recent answers are included