Tag Info

Hot answers tagged

155

It's not just about you. By forcing users to use TLS, they're creating a more secure environment for everyone. Without TLS being strictly enforced, users are susceptible to attacks such as sslstrip. Essentially, making unencrypted connections an option leads to the possibility of attackers forcing users into unencrypted connections. But that's not all. ...


79

Let me rephrase your question with a few extra details, which are implicit but maybe not obvious to everybody: "Isn't Google being Evil by providing me with a free email service and gigabytes of storage and forcing me into a secure connection when I access that service which they have generously granted to me and that nobody forces me to use even if I don't ...


59

It means much more than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just superseded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that could ...


56

As a matter of fact, yes, clients are vulnerable. So far the attention has been focused on servers as they are much more open to exploitation. (Almost) everyone can connect to a public HTTP/SMTP/... server. This blog describes how the bug actually works (it mentions dtls_process_heartbeat(), but tls_process_heartbeat() is affected in the same way). This ...


35

I am not aware of any definitive, "official" answer on this subject, but this seems to be part of an attempt at genericity and coherence. In the SSL/TLS standard, all messages follow regular encoding rules, using a specific presentation language. No part of the protocol "infers" length from the record length. One enlightening detail is the ClientKeyExchange ...


32

You have covered the main ones. In short: it's very hard, if not impossible, to effectively block a site you want. You can make it hard by using the techniques you've mentioned: blocking IPs, redirecting DNS, blocking HTTP requests to certain sites / containing certain keywords. These methods are thwartable by proxies (in the case of deep packet ...


25

For TLS with the purpose of liveliness (keep-alive) checks, there's no reason to: Encode a payload size field in the heartbeat request/response header (the length of the payload comes from the record layer rrec.length in OpenSSL code -- you just have to subtract off the fixed HB header size from this), Allow HBs to be variable size -- a small HB size (in ...


22

When data is exchanged over the Internet, it hops from router to router, starting with the source (your desktop computer) and ending with the destination (the authentication server to which you are sending the password). All the routers, by definition, "see" the data. Moreover, all machines which are directly plugged with the link between any two routers can ...


21

I wrote a Metasploit module to test this, its currently being reviewed, but should hit the master branch relatively soon. The first version is merged into the master branch at this point. https://github.com/rapid7/metasploit-framework/blob/38a2614fbee1851252462c858057738c06a9f2ab/modules/auxiliary/server/openssl_heartbeat_client_memory.rb Unlike the ...


14

In fact, no, Google is not evil with this, not at all. The first important thing about this is that the use of secure connection is not a user preference or some personalized setting. Some people might find this confusing because they are familiar with a system only from the position of an end-user. Being a software developer myself, I can tell you that ...


14

There are no technical reasons for such a limit, it's purely licensing (i.e. revenue, and maintaining market segmentation). There are some considerations relating to the secure transfer of the key between systems when you do this, but this is easily addressed. If you violate the license or terms of an agreement you risk (at least) getting your certificate ...


14

The heartbeat serves two purposes: to make some link-level activity (to avoid closure by zealous firewalls) and to make sure that the peer is still alive. If you want to do both with empty fragments, then you need some convention between client and server, so that when you send an empty fragment, the peer responds with an empty fragment. This has potential ...


14

If you look into RFC6520 (heartbeat extension) there is a padding after the payload. So the length is required to know where the payload ends and the padding starts. Apart from that I find the design overengineered: the both reasons for this extension seem to be to make PMTU possible (by using messages of different size) and by having heartbeat to know if ...


11

"Efficiency" depends on your goals. An important point to be made is that all blocking techniques can be circumvented, at a price. For instance, an individual can use a satellite phone to get connectivity which cannot be blocked by his country, save by direct physical intervention of armed forces. But using such systems is quite expensive. Countries which ...


11

The 64k block that gets returned is selected effectively at random, which seems like it would make it hard to find worthwhile data. However, there are two factors that significantly increase the threat: First, the attack won't return memory that was allocated during program start-up. This means the area occupied by boring things like program code won't ...


10

Evil for forcing you to use a secure connection? No, I don't think it's evil. It protects the community at large with no downside to you as an individual. I think its only evil if they're forcing you to use SSL/TLS, then failing to use forward secrecy, thus giving you and everyone else using the service a false sense of security. Without forward secrecy, ...


9

You are confusing RSA, a family of cryptosystems that relies on the difficulty of factoring products of large prime numbers, with RSA Security LLC, a company which sells security-related products. RSA and RSA are both called RSA after Messrs R, S and A, who both invented the RSA cryptosystem and founded the RSA company. The company was founded in part to ...


9

You can try StartSSL who will issue you a free SSL certificate that will be trusted. I use one of their certificates on my blog and yes, it really is free. Their site doesn't have the best user interface admittedly, but if you can live with that, this sounds like your best option.


9

You are correct. Some ways for the site to decrease that attack vector would be to... Use an HSTS header to prevent any data from being sent to the site in plaintext. Advertise only the HTTPS URL and do not allow any plaintext connections. This will ensure most bookmarks use encryption. The point being that sites should force SSL from the beginning, ...


9

A one time pad offers information theoretic security. This essentially means that the one time pad cannot be broken even if the adversary has unlimited computing power. This is because XOR-ing any data against a truly random key will guarantee that the output be random as well because you are simply flipping bits.


8

It's sad that people's first reaction is to defend Google by using the "you don't HAVE to use it" fallacy. As for transaction of money, don't you think your own personal information which they sell to advertisers has monitory value? Google isn't free, it still requires a payment which most people don't even realize they are making. Now, to answer the ...


8

Yes, and this is exactly what the SSL Strip attack did, while using the unsecure HTTP connection it transparently turned all HTTPS links in to HTTP links and proxied the connection, if you did not notice that you where not on a HTTPS connection you could easily send confidential data over a unsecure connection. As a web site admin you can combat this by ...


7

I disagree with Mark. A main goal of SSL/TLS is the protection of the long term key (i.e. the private certificate). If an attacker can obtain the key, the implementation must be considered broken. It does not matter if you use two-factor authentication or not. If I know the server's secret key, I can decrypt your traffic either directly (without PFS) or via ...


6

Google not only protects you and your data, but also themselves. The vast majority of internet users out there does not know about security, and does not care about. When offering any insecure path as fallback, user's would use it, and if it is some man-in-the-middle breaking everything else. If your account is compromised, that's not only a problem for ...


6

This is the worst case scenario, as described by Codenomicon who set up the quoted web site. The "raw" vulnerability description is: A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. (OpenSSL) I am not saying that they gone too far, it IS very very ...


6

There are two main ways in which SSL/TLS and EAP may mix: EAP-TLS and EAP-TTLS. Basically, EAP is a generic protocol for exchanging "messages", and the "authentication method" defines the message contents. In the case of the TLS-based EAP methods, the messages contain the various handshake messages from SSL/TLS. In EAP-TLS, the normal case is that the client ...


6

It is possible to exploit the bug in clients. This tester can be used to give out an 'evil' URL to arbitrary clients and see if they take the bait or not. I found 3 top 100 websites (I won't name them here) that fetch URLs using clients that were vulnerable as of 2014-04-09.


6

The whole heartbleed story has gone way beyond sanity, for sure. The bug is real and can be a serious threat to any server. However, the bug is no more serious than all other "buffer overrun" attacks, and arguably less serious than write overflows, which can more easily lead to hostile server hijack. You can have a list of reported security issues for ...


6

PFS does, in fact, prevent reading the log files after-the-fact. The only use for a captured private key in a PFS arrangement is impersonation. You can't use it for passive snooping in any context, either after-the-fact or indeed live. This is because in a PFS configuration, the ephermal session key is generated using Diffie-Hellman between the two parties ...


5

Some research on this topic: Empirical Analysis of Internet Filtering in China (2003) For some 1,043 of sites tested, we confirmed that DNS servers in China report a web server other than the official web sever actually designated via each site's authoritative name servers. We call this phenomenon "DNS redirection," though others sometimes refer to the ...



Only top voted, non community-wiki answers of a minimum length are eligible