Linked Questions
11 questions linked to/from How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
5
votes
1
answer
5k
views
OpenSSL Heartbeat (Heartbleed bug) - what's the payload used for? [duplicate]
So the heartbeat bug can lead to memory read overrun, exposing (parts of) the process memory, because it reads the payload when there actually is no (or less) payload.
But what do you need a payload ...
- 211
3
votes
1
answer
700
views
Where/what is the actual HeartBleed bug? [duplicate]
I've read lots of reports of the HeartBleed bug but have not been able to find a description at the source-code level, such as this one for the goto fail bug. Can anyone provide, or point to, such an ...
- 671
-4
votes
1
answer
790
views
How does the Heartbleed exploit work? [duplicate]
I was wondering, what it means in the Heartbleed exploit. Let me explain. I'm trying to understand what does "hello" and "heartbeat" mean. Example:
hello = h2bin("16 03 02 00 dc 01 00 00 d8 03 02 53
...
- 101
1
vote
0
answers
82
views
Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]
I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following.
Situation A
If I would use a regular SSL/TLS connection the handshake will ...
- 277
114
votes
5
answers
57k
views
What should a website operator do about the Heartbleed OpenSSL exploit?
CVE-2014-0160
http://heartbleed.com
This is supposed to be a canonical question on dealing with the Heartbeat exploit.
I run an Apache web server with OpenSSL, as well as a few other utilities ...
- 5,337
61
votes
2
answers
23k
views
Does the heartbleed vulnerability affect clients as severely?
If I have a web crawler (using a non-patched version of OpenSSL) that can be coaxed to connect to an evil https-site, can they get everything from my process memory? To attack a server you can keep ...
- 721
16
votes
7
answers
12k
views
My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?
I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps.
...
- 263
8
votes
2
answers
2k
views
Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [closed]
I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers.
Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
- 423
11
votes
3
answers
8k
views
How paranoid should the average user be about heartbleed? [duplicate]
Questions about Heartbleed have been showing up in the popular questions list today since morning, from the security stack exchange to android
I have been reading many of them, most of them are ...
- 359
5
votes
1
answer
1k
views
Does xkcd.com/1353 overstate heartbleed's capability?
Today's xkcd has characters discussing heartbleed:
Megan: I mean, this bug isn't just broken encryption.
Megan: It lets website visitors make a server dispense random memory contents.
Megan: It's ...
- 39.3k
4
votes
2
answers
674
views
Heartbleed and heap management - Why user data and passwords are kept in memory?
If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
- 2,748