0

What are the possibilities that someone will get sensitive information via the HeartBleed exploit ?

As far as I can see, this exploit needs someone or something to "send" the exploit to the server, so if no one is using the vulnerable server then the attacker must wait for a long time to get sensitive information?

  • I'm not quite sure if I understand your question. In order to obtain sensitive data, there has to be sensitive data to get. So, yes, you understand correctly. – schroeder Nov 28 '16 at 21:29
  • So if I will be an attacker, I would make sure that exploit would loop for so long till it get's sensitive information. How can I detect such attack on server side ? – ZeroByte Nov 28 '16 at 21:31
  • I'm still not sure if I understand. I think you are confusing another vulnerability with Heartbleed. I think you are meaning the DROWN attack. – schroeder Nov 28 '16 at 21:35
4

HeartBleed is a way to get a chunk of the server's memory. Regardless of whether or not someone is actively looking at sensitive data, there is at least one piece of sensitive data that will be resident in the server's memory - the server's private key for the ssl certificate. We know that is actively in use because the attacker's own connection would have needed to be established with that key.

If no-one else has used the server, that may be the extent of it, but that key is sufficient to allow the opportunity for attackers to perform man-in-the-middle attacks and/or otherwise impersonate the server.

If the server is in active use and is sending back sensitive information, the contents of those requests/responses (which may include user/passwords) may (or may not) be found in the returned chunk of memory. Other possibilities for an active server include session keys and potentially sensitive usage data.

All in all, it is a bad one - make sure you're patched.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.