1

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced.

Below is an excerpt from the subsequent output: (Some of which, appears to be binary or encrypted.)

...................................................................../index.php......RC4-SHA.RC4-SHA.Xq?...............?.......?.....index...php.ex.h....................SHA.application
/x-httpd-php.mod_ssl/2.2.14..mod_ssl/2.2.14..OpenSSL/1.0.1e..OpenSSL/1.0.1e..TLSv1.2.NULL....RC4-SHA.RC4-SHA.false...false.............128...128...............128...128.....NONE....3.......3........
ABF42CCAC60E1D07........ABF42CCAC60E1D07........ABF42CCAC60E1D07........Jul 12 04:20:13 2011 /L=Taipei/O=QNAP Systems Inc./OU=NAS/CN=TS Series NAS/emailAddress=q_support@qnap.com....
/C=TW/ST=Taiwan/L=Taipei/O=QNAP Systems Inc./OU=NAS/CN=TS Series NAS...q_support@qnap.com......q_support@qnap.com......
/C=TW/ST=Taiwan/L=Taipei/O=QNAP Systems Inc./OU=NAS/CN=TS Series NAS/emailAddress=q_support@qnap.com..../C=TW/ST=Taiwan/L=Taipei/O=QNAP Systems Inc./OU=NAS/CN=TS Series 
NAS/emailAddress=q_support@qnap.com....TW......TW......Taiwan..Taiwan..Taipei..Taipei..\T.BdT.BPTTH,N.B..?._LSSDN.B8.?._LSSXN.BH.?._LSShN.BP.?._LSS|N.B`.?._LSS.N.Bp.?._LSS.N.B..?._LSS.N.B..?._ 
LSS.N.B..?._LSS.Q.B..?._LSS.Q.B..?._LSS.Q.BH.?._LSS.Q.B..?._LSS.Q.B0.?._LSS.R.B..?._LSS.R.B..?._LSS,R.B..?._LSS@R.B..?._LSSTR.B..?._LSShR.B..?._LSS.R.B@.?._LSS.S.B..?._LSS.S.B0.?._LSS0S.B@.?._
LSSDS.BP.?._LSSXS.B..?._LSSlS.B..?._LSS.S.B..?._LSS.T.B(.?._LSS$T.BP.?._LSS8T.Bx.?._LSSLT.B..?._LSS.............................................................................................
.............................................................................................................QNAP Systems Inc........QNAP Systems Inc........NAS.....NAS.....TS Series NAS...TS Series
NAS...q_support@qnap.com......q_support@qnap.com......rsaEncryption...rsaEncryption...sha1WithRSAEncryption...sha1WithRSAEncryption...F12392A6F7C71C1A30642791B394C4BBAF8103A6772BD28E387CBD4979FC7AEE
........F12392A6F7C71C1A30642791B394C4BBAF8103A6772BD28E387CBD4979FC7AEE..............................................................................................................................

What exactly is this data?

In particular; these hexadecimal character strings look like some sort of keys/hashes:

F12392A6F7C71C1A30642791B394C4BBAF8103A6772BD28E387CBD4979FC7AEE

ABF42CCAC60E1D07

Is this information of any particular use or interest to would-be attackers / eaves-droppers??

  • 1
    This seems to be a part of a certificate. If I am right and this it is a certificate, then it is not sensitive. – Lukas May 11 '16 at 15:04
  • 1
    The bit that "remains encrypted" could easily be the private key. – Polynomial May 11 '16 at 15:50
  • @Polynomial Implying that the server wasn't vulnerable? Or that the exploit failed? – voices May 11 '16 at 15:59
  • 1
    @tjt263 The exploit definitely worked. You just need to do memory forensics to extract interesting info from the blob that came back. – bonsaiviking May 11 '16 at 17:05
4

Heartbleed results in arbitrary server memory being disclosed. Sometimes this contains sensitive information. In some cases, this is the server's private key, which can be the most sensitive information on the server. In many cases, it can contain information that is intended for a different client. This is probably what you are seeing: certificates, version strings, and other information used internally by the web server.

  • Hey, @bonsaiviking. "Heartbleed results in arbitrary server memory being disclosed." So it comes directly from the RAM of the vulnerable host? Am I reading that right? – voices May 11 '16 at 16:44
  • @tjt263 Yes, that's right. – bonsaiviking May 11 '16 at 17:04
  • So, that's kind of incredible. And the encrypted-looking content is probably actually, like.. raw binary data, then? – voices May 11 '16 at 17:14
  • @tjt263 could be possibly anything from junk to cyptographic keys – Lukas May 11 '16 at 20:57
  • @Lukas Wouldn't it be "human-readable" if that were the case? – voices May 12 '16 at 15:15
2

Heartbleed exposes, as the other answer mentioned, arbitrary memory. On an unused NAS, this is most likely not sensitive information.

Yet, this seems to be a certificate - maybe also, as polynomial said, (part of) the private key.

Executing the exploit several times will probably yield different outputs; putting the pieces together can in fact yield passwords in plain text, tokens and other sensitive information, especially on servers with some usage on them.

Your questions in the comments suggest you didn't understand what the exploit does, though, because nothing "remains encrypted" - you basically get a dump of some portion of memory. If that is actually encrypted memory, heartbleed will not help there.

But more often than not, that "encrypted" (e.g. Random-looking bytes) data may be private keys or internally used symmetric keys.

Try executing the exploit several times in a row with some load on the machine and you will be able to extract the private key for the certificate if you didn't already.

With that, you could do a MITM - yet this is not as interesting for a NAS as is for a publicly reachable web server for example.

  • Running the exploit consecutively, in this case, consistantly returns one of two variants of what look like the top and tail of the same string. – voices May 11 '16 at 16:51
  • Right. So stitch it together and you have a private key and a certificate, hopefully. – Tobi Nary May 11 '16 at 16:53
  • I can give you more details, privately, if you want to test it yourself. – voices May 11 '16 at 17:00
  • I don't need to, thanks. Did my heartbleed homework when it was due;) – Tobi Nary May 11 '16 at 17:01
  • lol. No worries. This is just independant research for my own interest, though; FYI. – voices May 11 '16 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.