2

This question already has an answer here:

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct?

Or can this be done to any server directly over the internet? I always thought packet sniffing had to be done locally

marked as duplicate by Rory Alsop Apr 23 '14 at 5:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Please read the many, many posts (over 100) we already have on Heartbleed. You will find your answer there. – Rory Alsop Apr 23 '14 at 5:45
2

Heartbleed does not have anything related to packet sniffing for the exploit to work. It is exploiting an buffer overflow bug which then gain accesses to the server memory. A normal heartbeat request would be like

User : request server to reply "Hello"

Server: reply "Hello"

Now after exploiting the buffer overflow

User : request server to reply - part of their stored memory

Server : reply - stored memory that might contains private key, password and whatever data that is stored on their memory.

In summary, heartbleed steals the information but sending abnormal request to the server to return part of their memory data instead of simple "Hello" packets.

Not the answer you're looking for? Browse other questions tagged or ask your own question.