Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
What are the possibilities that someone will get sensitive information via the HeartBleed exploit ?
As far as I can see, this exploit needs someone or something to "send" the exploit to the server, so if no one is using the vulnerable server then the attacker must wait for a long time to get sensitive information?
HeartBleed is a way to get a chunk of the server's memory. Regardless of whether or not someone is actively looking at sensitive data, there is at least one piece of sensitive data that will be resident in the server's memory - the server's private key for the ssl certificate. We know that is actively in use because the attacker's own connection would have needed to be established with that key.
If no-one else has used the server, that may be the extent of it, but that key is sufficient to allow the opportunity for attackers to perform man-in-the-middle attacks and/or otherwise impersonate the server.
If the server is in active use and is sending back sensitive information, the contents of those requests/responses (which may include user/passwords) may (or may not) be found in the returned chunk of memory. Other possibilities for an active server include session keys and potentially sensitive usage data.
All in all, it is a bad one - make sure you're patched.
