Linked Questions

5 votes
1 answer
6k views

OpenSSL Heartbeat (Heartbleed bug) - what's the payload used for? [duplicate]

So the heartbeat bug can lead to memory read overrun, exposing (parts of) the process memory, because it reads the payload when there actually is no (or less) payload. But what do you need a payload ...
basic6's user avatar
  • 211
3 votes
1 answer
715 views

Where/what is the actual HeartBleed bug? [duplicate]

I've read lots of reports of the HeartBleed bug but have not been able to find a description at the source-code level, such as this one for the goto fail bug. Can anyone provide, or point to, such an ...
Ellen Spertus's user avatar
-4 votes
1 answer
817 views

How does the Heartbleed exploit work? [duplicate]

I was wondering, what it means in the Heartbleed exploit. Let me explain. I'm trying to understand what does "hello" and "heartbeat" mean. Example: hello = h2bin("16 03 02 00 dc 01 00 00 d8 03 02 53 ...
Zerquix18's user avatar
  • 101
1 vote
0 answers
82 views

Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]

I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following. Situation A If I would use a regular SSL/TLS connection the handshake will ...
stUrb's user avatar
  • 277
115 votes
5 answers
57k views

What should a website operator do about the Heartbleed OpenSSL exploit?

CVE-2014-0160 http://heartbleed.com This is supposed to be a canonical question on dealing with the Heartbeat exploit. I run an Apache web server with OpenSSL, as well as a few other utilities ...
Deer Hunter's user avatar
  • 5,347
61 votes
2 answers
24k views

Does the heartbleed vulnerability affect clients as severely?

If I have a web crawler (using a non-patched version of OpenSSL) that can be coaxed to connect to an evil https-site, can they get everything from my process memory? To attack a server you can keep ...
Gurgeh's user avatar
  • 721
16 votes
7 answers
12k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
user007's user avatar
  • 263
8 votes
2 answers
2k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [closed]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
Michael's user avatar
  • 423
11 votes
3 answers
9k views

How paranoid should the average user be about heartbleed? [duplicate]

Questions about Heartbleed have been showing up in the popular questions list today since morning, from the security stack exchange to android I have been reading many of them, most of them are ...
user13267's user avatar
  • 359
5 votes
1 answer
1k views

Does xkcd.com/1353 overstate heartbleed's capability?

Today's xkcd has characters discussing heartbleed: Megan: I mean, this bug isn't just broken encryption. Megan: It lets website visitors make a server dispense random memory contents. Megan: It's ...
dr jimbob's user avatar
  • 39.4k
4 votes
2 answers
706 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
ack__'s user avatar
  • 2,758