5

Today's xkcd has characters discussing heartbleed:

Megan: I mean, this bug isn't just broken encryption. 
Megan: It lets website visitors make a server dispense random memory contents. 
Megan: It's not just keys. It's traffic data. Emails. Passwords. Erotic fanfiction. 
Cueball: Is everything compromised? 
Megan: Well, the attack is limited to data stored in computer memory. 
Cueball: So paper is safe. And clay tablets. 
Megan: Our imaginations, too. 

enter image description here This seems to imply that the heartbleed attack server compromises all of the computer's memory, not just that assigned to the webserver's processes and this is bad for reasons other than obtaining the private key at which point network eavesdropping and MitM attacks are possible. Is this true?

  • 1
    As you've said in your self-answer, it is not likely that Heartbleed can read memory from outside of the web server's own process. However, the important thing to bear in mind is that everything Megan enumerates in her first three lines may indeed be in that process' allocated memory space. Literally anything the website sends to or receives from its users is at risk, as well as some supporting data (e.g.: the private keys) required for the web server's operation. – Iszi Apr 9 '14 at 17:29
  • 2
    They're named Megan and Cueball? – Rubber Duck Apr 9 '14 at 17:31
  • @RubberDuck See here: explainxkcd.com/wiki/index.php/Category:Characters for a list of XKCD characters. – Iszi Apr 9 '14 at 17:37
  • 1
    I disagree with the "worst so far" claim. Bad as it may be, heartbleed is harmless compared to the 2008 Debian PRNG failure. – CodesInChaos Apr 9 '14 at 18:09
  • @CodesInChaos - I disagree with "worst so far" but heartbleed and the Debian PRNG failure seem to be on similar scale from my view; both make it trivial to circumvent the security of private keys in trusted widely-deployed software (and existed for years). The biggest difference is that heartbleed won't in most cases let you ssh to random remote machines, but only steal TLS keys and eavesdrop. (While Debian PRNG let you do both). – dr jimbob Apr 9 '14 at 18:55
8

Modern OSes use virtual memory spaces for each process that leads to process isolation. So it is impossible for a webserver using the flawed OpenSSL library to read memory allocated to other processes (not explicitly shared with the process), at best attempts to do so would result in a segmentation fault.

The truth is heartbleed is a simple overread of a buffer by trusting the payload size being sent in an attacker controlled header and never verifying that the payload was actually that size and written to memory (see [1], [2], [3]). The attacker sends a heartbeat packet to the server with a header saying the length of its payload being sent (the size in the header is two bytes hence up to ff ff = 65535 bytes), writes the sent payload to memory, and then reads back data of that size back to the client which allows to read whatever is in memory in the webserver's process following the written payload. This is quite important as you can repeat the attack many times and eventually may get lucky and be able to get private keys for the HTTPS server, and at that point you can MitM the HTTPS server. (And get at things like erotic fan fiction or user's email). Yes, in the meantime you may come upon random data that the webserver was already serving up, but really the private keys (and less so session cookies) is the important part.

Furthermore, the scary part is that the attack does this in a way that will not be logged unless you are in a debug mode/eavesdropping every packet on the wire and log the beginning of every TLS handshake request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.