<div dir="ltr">But, wouldn't Heartbleed be an issue, only if you use SSL on the site? For example, if you have OpenWRT/Tomato/DD-WRT and logging via http (not https), then there is no exploit via OpenSSL?<br></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Fri, Apr 11, 2014 at 3:26 PM, Bob Jonkman <span dir="ltr"><<a href="mailto:bjonkman@sobac.com" target="_blank">bjonkman@sobac.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
If you're using a tool to check for Heartbleed vulnerabilities, be<br>
sure to check the Web interface on your router and/or modem as well.<br>
<br>
I'm not sure if router vendors are on top of this, but according to<br>
ssltest.py my Tomato/MLPPP Version 1.25-mp3alpha6 (from<br>
<a href="http://fixppp.org" target="_blank">http://fixppp.org</a> ) is not vulnerable, nor my Thomson Speedtouch modem<br>
with firmware 6.1.0.5<br>
<br>
Also, somebody asked me how safe these vulnerability checking tools<br>
are, especially the online and Javascript-based ones. What's to say<br>
they're not merely displaying "all is well", and actually compiling a<br>
list of vulnerable sites for later exploitation?<br>
<br>
- --Bob.<br>
<br>
<br>
On 14-04-08 12:06 PM, Khalid Baheyeldin wrote:><br>
> You can use this python tool ssltest.py to check if your servers<br>
> are vulnerable:<br>
><br>
> $ wget -O ssltest.py "<a href="http://pastebin.com/raw.php?i=WmxzjkXJ" target="_blank">http://pastebin.com/raw.php?i=WmxzjkXJ</a>" $<br>
> python ssltest.py <a href="http://example.com" target="_blank">example.com</a><br>
<div><div class="h5"><br>
<br>
On 14-04-11 10:51 AM, CrankyOldBugger wrote:<br>
> Mashable has a list going of sites affected by Heartbleed:<br>
><br>
> <a href="http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/" target="_blank">http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/</a><br>
><br>
> Don't forget to add Canada Revenue (and most other government<br>
> sites) to your list of passwords to change!<br>
<br>
<br>
<br>
</div></div>Bob Jonkman <<a href="mailto:bjonkman@sobac.com">bjonkman@sobac.com</a>> Phone: <a href="tel:%2B1-519-669-0388" value="+15196690388">+1-519-669-0388</a><br>
SOBAC Microcomputer Services <a href="http://sobac.com/sobac/" target="_blank">http://sobac.com/sobac/</a><br>
<a href="http://bob.jonkman.ca/blogs/" target="_blank">http://bob.jonkman.ca/blogs/</a> <a href="http://sn.jonkman.ca/bobjonkman/" target="_blank">http://sn.jonkman.ca/bobjonkman/</a><br>
Software --- Office & Business Automation --- Consulting<br>
GnuPG Fngrprnt:04F7 742B 8F54 C40A E115 26C2 B912 89B0 D2CC E5EA<br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.14 (GNU/Linux)<br>
Comment: Ensure confidentiality, authenticity, non-repudiability<br>
<br>
iEYEARECAAYFAlNIQdEACgkQuRKJsNLM5epRdwCg2lOb8IU+MasK5tbnLKueZNcf<br>
KEoAoNhd+K0k9s0y4zKqtof8iYTxxOHY<br>
=Sm+H<br>
-----END PGP SIGNATURE-----<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
_______________________________________________<br>
kwlug-disc mailing list<br>
<a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a><br>
<a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" target="_blank">http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Khalid M. Baheyeldin<br><a href="http://2bits.com" target="_blank">2bits.com</a>, Inc.<br>Fast Reliable Drupal<br>Drupal optimization, development, customization and consulting.<br>
Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br>Simplicity is the ultimate sophistication. -- Leonardo da Vinci<br>For every complex problem, there is an answer that is clear, simple, and wrong." -- H.L. Mencken<br>
</div>