6

Are there any known instances of malicious security breeches exploiting the Heartbleed vulnerability? Or is there at present only a known vulnerability, albeit a very serious one?

  • 3
    Nice try, FBI. No but seriously, I don't think the kind of people that go around trying to exploit the internet are going to visit this site and tell you about it. – Luc Apr 9 '14 at 0:16
  • 1
    I agree entirely, Luc. But known use of a vulnerability by bad guys is different from a knwon vulnerability. For example, the initial detection of an already widespread malicious worm is worse news, in at least one sense, than detection of a vulnerability that, based on available public knowledge, may not have been exploited maliciously. – user43772 Apr 9 '14 at 2:09
  • Canadian Revenue Agency and Mumsnet are reportedly affected. – Deer Hunter Apr 14 '14 at 18:02
3

There's several proof of concept examples out there, and researchers have been able to use these to steal private keys and user login credentials, among other things.

I have come across a blog post detailing how to use a python script to automate fetching user session information from a vulnerable server. I have also heard people were able to steal Yahoo login credentials in plain text.

So yes - There are attacks that work and potentially anyone could be using them right now.

| improve this answer | |
  • I am sorry, when I said "known attack", I should have said "known instance of a malicious security breech exploiting the Heartbleed vulnerability". I'll try to edit the question. – user43772 Apr 9 '14 at 1:51
  • 4
    @fsb That's the scariest part of the whole thing - There is virtually no way to know if someone has used it to breach the security of your server (other than the aftermath - eg. customers getting scammed) – William Lawn Stewart Apr 9 '14 at 2:53
  • William, yes, absolutely. Given SSL and how it's typically used, with one key used to auth and encrypt, and the bug allows the key to be stolen without trace, it's hard to imagine a worse bug for secure web communications. – user43772 Apr 10 '14 at 12:30
3

Well, for the purely malicious, those tend to be secret until the results are leaked.

For an attack that actually found someone's password, there is this Twitter example of a Yahoo.com user's login name and password from Mark Loman, which is pretty clear that at least 1 user's login credentials have been seen by someone using Heartbleed.

| improve this answer | |
  • Thanks for the link about Yahoo. It doesn't look like forensics from a criminal attack but it's a great demo of the bug. – user43772 Apr 10 '14 at 12:33
  • @fsb you're welcome; you'll have to browse sites criminals frequent to increase your odds of finding criminals bragging about an attack. But first, yank all hard drives physically out and use a TAILS LiveCD. Afterwards, throw the motherboard (and it's possibly compromised BIOS) away :). If you do find something (perhaps pastebin or a similar site?), then reference it in your own answer! – Anti-weakpasswords Apr 11 '14 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy