Tag Info

Hot answers tagged

227

How about this one from XKCD? The most "non-technical" explanation I found.


209

This is not a flaw in TLS; it is a simple memory safety bug in OpenSSL. The best explanations I've run across so far are the blog posts Diagnosis of the OpenSSL Heartbleed Bug by Sean Cassidy and Attack of the week: OpenSSL Heartbleed by Matthew Green. In short, Heartbeat allows one endpoint to go "I'm sending you some data, echo it back to me". You send ...


135

I'm going to have to use a few technical terms, but will try to keep them to a minimum and describe them. Basic Intro to TLS & Encryption You (a client) go to a website (known as a server) that uses encryption (the address starts with https://) to make it so no one but you and the website at the other end can know the content of the messages you are ...


91

The analogy of the bank and bank employee You call the bank to request a new bank account, to make an appointment - whatever. Somehow you and the bank make sure that you are who you are, and the bank is actually the bank. This is the TLS process that secures the connection between you and the bank, and we assume this is handled properly. The roles in this ...


62

There is more to consider than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just supersceded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that ...


58

It means much more than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just superseded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that could ...


36

In really plain English: the attacker says they're sending a packet of size "x" and asks the server to send it back, but actually sends a much smaller packet. The OpenSSL library trusts the attacker, sends back the small real packet as the start of the reply, and then grabs data from memory to fill out the reply to the expected size. This could be any data ...


28

I am not aware of any definitive, "official" answer on this subject, but this seems to be part of an attempt at genericity and coherence. In the SSL/TLS standard, all messages follow regular encoding rules, using a specific presentation language. No part of the protocol "infers" length from the record length. One enlightening detail is the ClientKeyExchange ...


25

End users should just wait until their sysadmins contact them with further instructions. At some point, after your sysadmins have patched vulnerable systems, you may have to: Change passwords Login again (because all session keys and cookies need to be invalidated) Help senior management evaluate the actual content handled by the vulnerable servers that ...


21

For TLS with the purpose of liveliness (keep-alive) checks, there's no reason to: Encode a payload size field in the heartbeat request/response header (the length of the payload comes from the record layer rrec.length in OpenSSL code -- you just have to subtract off the fixed HB header size from this), Allow HBs to be variable size -- a small HB size (in ...


20

Directly copied from OpenSSL site OpenSSL Security Advisory [07 Apr 2014] TLS heartbeat read overrun (CVE-2014-0160) A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. ...


19

What happens for private key storage is a bit intricate because it involves several layers of underspecified crud accumulated over years and kept for backward compatibility. Let's unravel the mystery. For its cryptographic operations, including private key storage (that which we are presently interested in), OpenSSH relies on the OpenSSL library. So OpenSSH ...


18

There is a well-written analysis at http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html complete with code samples. The author, Sean Cassidy, notes that (emphasis mine): What if the requester didn't actually supply payload bytes, like she said she did? What if pl really is only one byte? Then the read from memcpy is going to ...


15

If you consider the bug as reading out of bounds of the current structure, than this would probably have been prevented in other languages, because one does not have unbound access to memory and would need to implement these things differently. But I'd rather would classify this bug as missing validation of user input, e.g. it believes that the size sent in ...


14

Try this: openssl genrsa | openssl rsa -text Look at each of the fields; the primes, the exponents, all of them. Now try again, and again, and again. You'll notice some inconsistency as to whether an initial zero byte is present. Sometimes it is, sometimes it's not. The pattern is this: if the first bit of the first "real" byte is set -- that is, if the ...


13

If you look into the RFC6520 (heartbeat extension) there is a padding after the payload. So the length is required to know where the payload ends and the padding starts. Apart from that I find the design overengineered: the both reasons for this extension seem to be to make PMTU possible (by using messages of different size) and by heaving heartbeat to know ...


12

In OpenSSL source code, the speed aes-256-cbc function calls AES_cbc_encrypt() which itself uses AES_encrypt(), a function from crypto/aes/aes_x86core.c. It is an obvious "classical" implementation with tables. On the other hand, with EVP, you end up in the code in crypto/evp/e_aes.c which dynamically detects whether the current CPU supports the AES-NI ...


12

Actually none of these languages would have prevented the bug, but they would have lessened the consequences. OpenSSL's code is doing something which, from the abstract machine point of view, is nonsensical: it reads more bytes from a buffer than there actually are in a buffer. With C, the read still "works" and returns whatever bytes lingered after the ...


11

You are out of luck. A passphrase protected encrypted private key means you have to guess it and with the high entropy of a typical passphrase it will be very difficult. Granted if you have a rough idea of what the passphrase is, you can write a script to try to brute force it (e.g., it was something like 'correct battery horse __' and subject to a ...


11

As the author of the Ruby AEAD library, I can assure you that OpenSSL does support GCM on 1.0.1c. ~ $ /usr/local/bin/openssl version OpenSSL 1.0.1c 10 May 2012 ~ $ /usr/local/bin/openssl enc -help 2>&1 | grep gcm -aes-128-gcm -aes-192-gcm -aes-256-gcm If it is unavailable on your platform (OpenSSL added GCM support in 1.0.1, I believe), I have ...


11

When computing DHPARAM you will get these as the output while computing Diffie Hellman parameters: . : A potential prime number was generated. + : Number is being tested for primality. * : A prime number was found. References: source code (at the bottom) man pages for the functions


11

Reading bytes from a device can be troublesome (you have to account for syscall specificities, e.g. interrupted system calls) and can potentially be inefficient if reading many small chunks (a syscall has a non-negligible overhead). A custom software PRNG, seeded with bytes from /dev/urandom, gives more control over performance. (Also, there might be a bit ...


11

According to the document you linked to, the APR connector Uses OpenSSL for TLS/SSL capabilities (if supported by linked APR library) Therefore, it would be reasonable to assume that the Tomcat Native Library would be vulnerable to the Heartbleed bug. However, the conditions are different, because Tomcat is written in Java, and Java has its own ...


10

I've found a nice post from a Cisco Support Engineer regarding to the ASA: However, if you are trying to find the OpenSSL version for an ASA (Adaptive Security Appliance), you can determine this version from the ASA release notes. Simply examine the "Open Source" notes that are located in the release notes of the particular ASA image you are concerned ...


10

Here's an attempt to use almost no jargon at all. When you connect to a "secure" website (one with a green bar and padlock icon), your browser and the website perform a bit of mathematical hocus-pocus and you both end up with a secret key - like a very long, random password - with which you can send each other encrypted messages. As you browse around the ...


10

The 64k block that gets returned is selected effectively at random, which seems like it would make it hard to find worthwhile data. However, there are two factors that significantly increase the threat: First, the attack won't return memory that was allocated during program start-up. This means the area occupied by boring things like program code won't ...


9

The point of the salt is to prevent precomputation attacks, such as rainbow tables. Without a salt, anyone could just generate a huge dictionary of hashes and their associated plaintexts, and immediately crack any known hash. With the salt, such a dictionary is useless, since it's infeasible to generate such a dictionary for all possible salts. I did a ...


9

[edited] I made a tool to check the status of your SSL and see if heartbeat is enabled and vulnerable. Tool at: http://rehmann.co/projects/heartbeat/ There's another one at http://filippo.io/Heartbleed/ If you're vulnerable, please upgrade your OpenSSL packages & renew your certs!


9

To add on @scuzzy-delta's answer: by definition, buffer overruns in applicative code affect only applicative code. The operating system maintains the isolation between the various process, and won't permit a process to access the memory space of another process. If the buffer overrun is of the "write" persuasion (the attacker forces the target to write ...


9

This example dialog - perhaps you are both characters, or you get them to ask the questions of you: Q1: What's your favourite colour (1 word) A1: Blue Q2: Where did you last go on holiday (2 words) A2: To France Q2: What car do you drive (1000 words) A2: Vauxhall Astra. Cheeseburger. Tomorrow I'm driving to London. I like cake. Ohhh a squirrel. My ...



Only top voted, non community-wiki answers of a minimum length are eligible