[kwlug-disc] Heartbleed affected sites

Darcy Casselman dscassel at gmail.com
Mon Apr 14 23:18:54 EDT 2014


All that stuff is why you use a password manager like LastPass (which I use
tho, admittedly, isn't open source, but its
in-the-cloud-accessible-anywhere-ness is super-handy) or KeyPassX.

OpenID has morphed into "Log in with Google/Facebook/Twitter."  All of
which support two-factor authentication, which is handy.  People never
really bought into the idea of a URL being your identity.  If you want to
see modern OpenID in action, check out stackexchange sites.

Darcy.


On Mon, Apr 14, 2014 at 8:20 PM, unsolicited <unsolicited at swiz.ca> wrote:

> That's my point - it DOES hurt to change it.
>
> Time consumption to do so, and time wasted later trying to remember what
> you changed it to -this- time. Or chase down how you recorded it (e.g.
> browser cache / password lookup). Now repeat for every other place you've
> been encouraged to (pointlessly) change your password as well, which of
> course you did because the media knows all.
>
> Now multiply by number of users out there. And again by number of
> accessing devices. What a waste of resources.
>
> This is my issue - all very well to take corrective action to known and
> quantified issues, but not so to send everyone to chase their tail
> everywhere 'just in case.' The I.T. industry could and should do a better
> job for its users. I.T. is a tool, not an end in itself. The tail should
> not be wagging the dog.
>
> -----
>
> Your note makes me wonder ... wherefore OpenID on all this? (In the sense
> of being a single password.) And I wonder if (some day?) OpenID could go
> change all your passwords for you, and the user need only change their
> OpenID password.
>
> Given your note, I'm guessing that makes some sense to you too, if two
> factor authentication is used for OpenID there. [OpenID == (set of OpenID
> like services, which seems to more and more include gmail accounts)]
>
>
>
> On 14-04-14 11:12 AM, Darcy Casselman wrote:
>
>> I still contend that your Instagram password is the last thing you need to
>> worry about from Heartbleed.
>>
>> https://twitter.com/CP24/status/455686305305751553
>>
>> But sure, it doesn't hurt to change it.
>>
>> Although, as I write on my blog, relying on a shared secret for your
>> identity has been proven again and again to be insufficient.  Setting up
>> two-step verification with a one-time password is the best way right now
>> to
>> avoid having your credentials stolen from a server, regardless of how an
>> attacker gets that information.
>>
>> http://flyingsquirrel.ca/index.php/2014/04/12/enable-
>> two-factor-authentication/
>>
>> Darcy.
>>
>>
>> On Sat, Apr 12, 2014 at 4:15 PM, unsolicited <unsolicited at swiz.ca> wrote:
>>
>>  Yep, had caught those aspects.
>>>
>>> Keyword being 'potential'. Which is only to say, with the media all
>>> running around with their heads cut off, and only a small subset of such
>>> services you use WITH impacted servers AND real potential harm to you at
>>> exposure IF you have an account worth messing around with more lucrative
>>> than others, there's a lot of FUD out there.
>>>
>>> Which is not to say you won't be impacted, nor that it won't hurt when
>>> you
>>> are ... but it's not EVERYWHERE for EVERYTHING.
>>>
>>> I don't dispute the problem is discerning when it really matters.
>>>
>>> I'm only irritated that they put out carte blanche 'change everything'
>>> 'just in case'. This, my industry (I.T.), should be able to be rather
>>> more
>>> surgical, and less 'there MAY be risk, better safe than sorry'.
>>>
>>> Considering the time and expense and potential exposure most everyone is
>>> being told to expend. Most of which is pointless for lack of real
>>> exposure.
>>> That's my issue - lots of FUD and noise, most of it, just noise, and we
>>> all
>>> have better things to do.
>>>
>>>
>>>
>>> On 14-04-12 12:51 PM, Khalid Baheyeldin wrote:
>>>
>>>  Heartbleed extracted whatever happened to be in memory at the time. That
>>>> can be passwords or hashes or anything else.
>>>>
>>>> It is non-specific, but a determined attacker can potentially glean some
>>>> info with persistence.
>>>>
>>>> Also, because the attacker does not need to complete a connection that
>>>> would be logged (e.g. HTTP, ...etc.), this makes the attacks untraceable
>>>> with the usual logs (e.g. web server).
>>>>
>>>> This is what makes it scary: potential information disclosure, and non
>>>> traceablility.
>>>>
>>>>
>>>> On Sat, Apr 12, 2014 at 4:29 AM, unsolicited <unsolicited at swiz.ca
>>>> <mailto:unsolicited at swiz.ca>> wrote:
>>>>
>>>>      That's over simplistic.
>>>>
>>>>      You can't extract a password that isn't there.
>>>>
>>>>      *IF* it is even in the packet you get.
>>>>
>>>>      *IF* it was being exploited at the time.
>>>>
>>>>      *IF* you are of interest to them.
>>>>
>>>>      *IF* they are interested in doing damage to that provider of
>>>> services.
>>>>
>>>>      Lot of IFs. Lot of FUD.
>>>>
>>>>      What's being protected?
>>>>
>>>>      Will you know?
>>>>
>>>>      Will you care?
>>>>
>>>>      Not saying now that exploit known they wouldn't run with it.
>>>>
>>>>      But patching is simplistic.
>>>>
>>>>      I take your point about SSL keys - IF it was in the data returned.
>>>>
>>>>      But with properly isolated systems, it should only be the front end
>>>>      impacted. On the assumption that nobody inside your firewall is
>>>>      exploiting it.
>>>>
>>>>      Lots of IFs all around.
>>>>
>>>>      But I take your point.
>>>>
>>>>
>>>>
>>>>      On 14-04-11 05:44 PM, Bob Jonkman wrote:
>>>>
>>>>          -----BEGIN PGP SIGNED MESSAGE-----
>>>>          Hash: SHA1
>>>>
>>>>          If your router is accessible from the WAN port via http then
>>>> you
>>>>          have
>>>>          more urgent problems than Heartbleed.
>>>>
>>>>          If a site has both http and https then there's no (new)
>>>>          vulnerability
>>>>          with http, but a Heartbleed attack on https can still extract
>>>>          passwords and other info.
>>>>
>>>>          To extract a password from an http session a bad guy needs to
>>>> be a
>>>>          man-in-the-middle, or sniffing the network (remember
>>>> Firesheep?).
>>>> To
>>>>          extract a password with Heartbleed an attacker only has to
>>>>          initiate an
>>>>          https session.
>>>>
>>>>          - --Bob.
>>>>
>>>>
>>>>
>>>>          On 14-04-11 05:35 PM, Khalid Baheyeldin wrote:
>>>>
>>>>              But, wouldn't Heartbleed be an issue, only if you use SSL
>>>> on
>>>> the
>>>>              site? For example, if you have OpenWRT/Tomato/DD-WRT and
>>>> logging
>>>>              via http (not https), then there is no exploit via OpenSSL?
>>>>
>>>>
>>>>              On Fri, Apr 11, 2014 at 3:26 PM, Bob Jonkman
>>>>              <bjonkman at sobac.com <mailto:bjonkman at sobac.com>>
>>>>
>>>>              wrote:
>>>>
>>>>              If you're using a tool to check for Heartbleed
>>>>              vulnerabilities, be
>>>>              sure to check the Web interface on your router and/or
>>>> modem as
>>>>              well.
>>>>
>>>>              I'm not sure if router vendors are on top of this, but
>>>> according
>>>>              to ssltest.py my Tomato/MLPPP Version 1.25-mp3alpha6 (from
>>>>              http://fixppp.org ) is not vulnerable, nor my Thomson
>>>> Speedtouch
>>>>              modem with firmware 6.1.0.5
>>>>
>>>>              Also, somebody asked me how safe these vulnerability
>>>> checking
>>>>              tools are, especially the online and Javascript-based ones.
>>>>              What's
>>>>              to say they're not merely displaying "all is well", and
>>>> actually
>>>>              compiling a list of vulnerable sites for later
>>>> exploitation?
>>>>
>>>>              --Bob.
>>>>
>>>>
>>>>              On 14-04-08 12:06 PM, Khalid Baheyeldin wrote:>
>>>>
>>>>                          You can use this python tool ssltest.py to
>>>> check
>>>>                          if your
>>>>                          servers are vulnerable:
>>>>
>>>>                          $ wget -O ssltest.py
>>>>                          "http://pastebin.com/raw.php?__i=WmxzjkXJ
>>>>                          <http://pastebin.com/raw.php?i=WmxzjkXJ>"
>>>>                          $ python ssltest.py example.com <
>>>> http://example.com>
>>>>
>>>>
>>>>
>>>>
>>>>              On 14-04-11 10:51 AM, CrankyOldBugger wrote:
>>>>
>>>>                          Mashable has a list going of sites affected by
>>>>                          Heartbleed:
>>>>
>>>>                          http://mashable.com/2014/04/__
>>>> 09/heartbleed-bug-websites-__affected/
>>>>
>>>>                          <http://mashable.com/2014/04/
>>>> 09/heartbleed-bug-websites-affected/>
>>>>
>>>>
>>>>
>>>>          Don't forget to add Canada Revenue (and most other government
>>>>
>>>>                          sites) to your list of passwords to change!
>>>>
>>>>
>>>>
>>>>
>>>>              Bob Jonkman <bjonkman at sobac.com <mailto:bjonkman at sobac.com
>>>> >>
>>>>                        Phone: +1-519-669-0388 <tel:%2B1-519-669-0388>
>>>>
>>>>              SOBAC Microcomputer Services http://sobac.com/sobac/
>>>>              http://bob.jonkman.ca/blogs/
>>>>              http://sn.jonkman.ca/__bobjonkman/
>>>>
>>>>              <http://sn.jonkman.ca/bobjonkman/>
>>>>              Software   ---   Office & Business Automation   ---
>>>> Consulting
>>>>              GnuPG Fngrprnt:04F7 742B 8F54 C40A E115 26C2 B912 89B0 D2CC
>>>> E5EA
>>>>
>>>>
>>>>
>>>>                  _________________________________________________
>>>> kwlug-disc
>>>>                  mailing list kwlug-disc at kwlug.org
>>>>                  <mailto:kwlug-disc at kwlug.org>
>>>>                  http://kwlug.org/mailman/__
>>>> listinfo/kwlug-disc_kwlug.org
>>>>                  <http://kwlug.org/mailman/
>>>> listinfo/kwlug-disc_kwlug.org>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>              _________________________________________________
>>>> kwlug-disc
>>>>              mailing
>>>>              list kwlug-disc at kwlug.org <mailto:kwlug-disc at kwlug.org>
>>>>              http://kwlug.org/mailman/__listinfo/kwlug-disc_kwlug.org
>>>>              <http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org>
>>>>
>>>>          -----BEGIN PGP SIGNATURE-----
>>>>          Version: GnuPG v1.4.14 (GNU/Linux)
>>>>          Comment: Ensure confidentiality, authenticity,
>>>> non-repudiability
>>>>
>>>>          iEYEARECAAYFAlNIYh8ACgkQuRKJsN__LM5erCjgCfZAuLyG8v83bORUxPxTvs
>>>> __14m+
>>>>          r8kAoInhKmR99uQBN2cIt+__2KY3xq4KMl
>>>>          =6dTX
>>>>          -----END PGP SIGNATURE-----
>>>>
>>>>
>>>>
>>>>          _________________________________________________
>>>>          kwlug-disc mailing list
>>>>          kwlug-disc at kwlug.org <mailto:kwlug-disc at kwlug.org>
>>>>          http://kwlug.org/mailman/__listinfo/kwlug-disc_kwlug.org
>>>>          <http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org>
>>>>
>>>>
>>>>
>>>>      _________________________________________________
>>>>      kwlug-disc mailing list
>>>>      kwlug-disc at kwlug.org <mailto:kwlug-disc at kwlug.org>
>>>>      http://kwlug.org/mailman/__listinfo/kwlug-disc_kwlug.org
>>>>      <http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org>
>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Khalid M. Baheyeldin
>>>> 2bits.com <http://2bits.com>, Inc.
>>>>
>>>> Fast Reliable Drupal
>>>> Drupal optimization, development, customization and consulting.
>>>> Simplicity is prerequisite for reliability. --  Edsger W.Dijkstra
>>>> Simplicity is the ultimate sophistication. --   Leonardo da Vinci
>>>> For every complex problem, there is an answer that is clear, simple, and
>>>> wrong." -- H.L. Mencken
>>>>
>>>>
>>>> _______________________________________________
>>>> kwlug-disc mailing list
>>>> kwlug-disc at kwlug.org
>>>> http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org
>>>>
>>>>
>>>>
>>> _______________________________________________
>>> kwlug-disc mailing list
>>> kwlug-disc at kwlug.org
>>> http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org
>>>
>>>
>>
>>
>> _______________________________________________
>> kwlug-disc mailing list
>> kwlug-disc at kwlug.org
>> http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org
>>
>>
>
> _______________________________________________
> kwlug-disc mailing list
> kwlug-disc at kwlug.org
> http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://kwlug.org/pipermail/kwlug-disc_kwlug.org/attachments/20140414/ae3694ca/attachment.htm>


More information about the kwlug-disc mailing list