342

How about this one from XKCD? The most "non-technical" explanation I found.


248

This is not a flaw in TLS; it is a simple memory safety bug in OpenSSL. The best explanations I've run across so far are the blog posts Diagnosis of the OpenSSL Heartbleed Bug by Sean Cassidy and Attack of the week: OpenSSL Heartbleed by Matthew Green. In short, Heartbeat allows one endpoint to go "I'm sending you some data, echo it back to me". You send ...


209

@paj28's comment covers the main point. OpenSSL is a shared library, so it executes in the same user-mode address space as the process using it. It can't see other process' memory at all; anything that suggested otherwise was wrong. However, the memory being used by OpenSSL - the stuff probably near the buffer that Heartbleed over-reads from - is full of ...


163

The analogy of the bank and bank employee You call the bank to request a new bank account, to make an appointment - whatever. Somehow you and the bank make sure that you are who you are, and the bank is actually the bank. This is the TLS process that secures the connection between you and the bank, and we assume this is handled properly. The roles in this ...


161

I'm going to have to use a few technical terms, but will try to keep them to a minimum and describe them. Basic Intro to TLS & Encryption You (a client) go to a website (known as a server) that uses encryption (the address starts with https://) to make it so no one but you and the website at the other end can know the content of the messages you are ...


66

As a matter of fact, yes, clients are vulnerable. So far the attention has been focused on servers as they are much more open to exploitation. (Almost) everyone can connect to a public HTTP/SMTP/... server. This blog describes how the bug actually works (it mentions dtls_process_heartbeat(), but tls_process_heartbeat() is affected in the same way). This ...


64

There is more to consider than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just supersceded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that ...


61

It means much more than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just superseded Changing all passwords Invalidating all session keys and cookies Evaluating the actual content handled by the vulnerable servers that could ...


50

Yes, clients are vulnerable to attack. The initial security notices indicated that a malicious server can use the Heartbleed vulnerability to compromise an affected client. Sources below (all emphasis is mine). Since then, proof of concept attacks have validated this position - it is utterly certain that clients running apps that use OpenSSL for TLS ...


48

Your admin got it real wrong (or there was some translation mishap). TLS 1.1 and 1.2 fix some issues in TLS 1.0 (namely, predictability of IV for CBC encryption of records). It is possible to work around this issue in TLS 1.0, but it depends on how hard the implementations work at it. So, in that sense, TLS 1.1 and 1.2 are more secure than TLS 1.0, since ...


43

In really plain English: the attacker says they're sending a packet of size "x" and asks the server to send it back, but actually sends a much smaller packet. The OpenSSL library trusts the attacker, sends back the small real packet as the start of the reply, and then grabs data from memory to fill out the reply to the expected size. This could be any data ...


37

I am not aware of any definitive, "official" answer on this subject, but this seems to be part of an attempt at genericity and coherence. In the SSL/TLS standard, all messages follow regular encoding rules, using a specific presentation language. No part of the protocol "infers" length from the record length. One enlightening detail is the ClientKeyExchange ...


36

End users should just wait until their sysadmins contact them with further instructions. At some point, after your sysadmins have patched vulnerable systems, you may have to: Change passwords Login again (because all session keys and cookies need to be invalidated) Help senior management evaluate the actual content handled by the vulnerable servers that ...


32

For TLS with the purpose of liveliness (keep-alive) checks, there's no reason to: Encode a payload size field in the heartbeat request/response header (the length of the payload comes from the record layer rrec.length in OpenSSL code -- you just have to subtract off the fixed HB header size from this), Allow HBs to be variable size -- a small HB size (in ...


29

Short answer: Yes, all passwords. Long answer: At first sight, you only need to change the secret key of the certificate. But due to several reasons, all passwords are affected. Here's why: Reason 1: Chained attack Someone captured the secret key of the certificate. From that time on, he could decrypt all the traffic to that site. If you logged on for ...


26

I wrote a Metasploit module to test this, its currently being reviewed, but should hit the master branch relatively soon. The first version is merged into the master branch at this point. https://github.com/rapid7/metasploit-framework/blob/38a2614fbee1851252462c858057738c06a9f2ab/modules/auxiliary/server/openssl_heartbeat_client_memory.rb Unlike the server-...


23

No. You do not have to change all your passwords due to heartbleed. You have to change all your passwords because everybody seems to have become a huge herd of panicking sheep; changing your passwords will give you a warm feeling of doing something useful while you are running to your ultimate destination, which may well be off the nearest cliff. Such is the ...


23

TLS 1.0 TLS 1.0 was an upgrade from SSL 3.0 and the differences were not dramatic, but they are significant enough that SSL 3.0 and TLS 1.0 don't interoperate. Some of the major differences between SSL 3.0 and TLS 1.0 are: Key derivation functions are different MACs are different - SSL 3.0 uses a modification of an early HMAC while TLS 1.0 uses HMAC. The ...


22

This example dialog - perhaps you are both characters, or you get them to ask the questions of you: Q1: What's your favourite colour (1 word) A1: Blue Q2: Where did you last go on holiday (2 words) A2: To France Q3: What car do you drive (1000 words) A3: Vauxhall Astra. Cheeseburger. Tomorrow I'm driving to London. I like ...


21

Directly copied from OpenSSL site OpenSSL Security Advisory [07 Apr 2014] TLS heartbeat read overrun (CVE-2014-0160) A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. ...


21

Here is an example: My dad started getting browser certificate warnings when he went to Gmail. I looked in his hosts (C:\Windows\System32\drivers\etc\hosts ) file and some malware had edited it to redirect requests to gmail and a bunch of other sites to bad IP addresses that I assume the attacker controlled. His browser warned him because those bad IP ...


21

If you look at the Heartbleed summary: The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet ...


20

Actually none of these languages would have prevented the bug, but they would have lessened the consequences. OpenSSL's code is doing something which, from the abstract machine point of view, is nonsensical: it reads more bytes from a buffer than there actually are in a buffer. With C, the read still "works" and returns whatever bytes lingered after the ...


20

No. OpenBSD has measures (specifically, malloc() guard pages and wiping of deallocated memory) that should have turned Heartbleed into a crash or a leak of a whole bunch of "0x0d" bytes. However, as noted in a blog post here, OpenSSL uses its own custom memory-management system which acts to defeat those measures.


19

There is a well-written analysis at http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html complete with code samples. The author, Sean Cassidy, notes that (emphasis mine): What if the requester didn't actually supply payload bytes, like she said she did? What if pl really is only one byte? Then the read from memcpy is going to ...


18

It is hard to say exactly which apps/services are affected. This is because OpenSSL is a collection of programming code (referred to as a "library") that can be used to add TLS support to an application or system. TLS (Transport Layer Security) provides secure connections, and is best known for being the security layer behind HTTPS websites. So if a ...


17

If you consider the bug as reading out of bounds of the current structure, than this would probably have been prevented in other languages, because one does not have unbound access to memory and would need to implement these things differently. But I'd rather would classify this bug as missing validation of user input, e.g. it believes that the size sent in ...


14

If you look into RFC6520 (heartbeat extension) there is a padding after the payload. So the length is required to know where the payload ends and the padding starts. Apart from that I find the design overengineered: the both reasons for this extension seem to be to make PMTU possible (by using messages of different size) and by having heartbeat to know if ...


12

If you compilte OpenSSL with -DOPENSSL_NO_HEARTBEATS then you get an OpenSSL library and tools which can do anything that "normal" OpenSSL can do, except for the support of the SSL/TLS extension called "Heartbeat". That extension is described in RFC 6520. It is a pretty recent extension. As with all extensions, its use in any given SSL connections is ...


12

Changing passwords on a site that is/was vulnerable to Heartbleed is only effective after: The site has been patched to a non-vulnerable version of OpenSSL, or switched to use a different SSL implementation. A new SSL certificate has been issued and applied to the site. Old SSL certificates for the site have been revoked. All of the above being beyond your ...


Only top voted, non community-wiki answers of a minimum length are eligible