<div dir="ltr"><div>Heartbleed extracted whatever happened to be in memory at the time. That can be passwords or hashes or anything else.<br><br></div><div>It is non-specific, but a determined attacker can potentially glean some info with persistence.<br>
<br></div><div>Also, because the attacker does not need to complete a connection that would be logged (e.g. HTTP, ...etc.), this makes the attacks untraceable with the usual logs (e.g. web server).<br><br></div><div>This is what makes it scary: potential information disclosure, and non traceablility.<br>
</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Apr 12, 2014 at 4:29 AM, unsolicited <span dir="ltr"><<a href="mailto:unsolicited@swiz.ca" target="_blank">unsolicited@swiz.ca</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">That's over simplistic.<br>
<br>
You can't extract a password that isn't there.<br>
<br>
*IF* it is even in the packet you get.<br>
<br>
*IF* it was being exploited at the time.<br>
<br>
*IF* you are of interest to them.<br>
<br>
*IF* they are interested in doing damage to that provider of services.<br>
<br>
Lot of IFs. Lot of FUD.<br>
<br>
What's being protected?<br>
<br>
Will you know?<br>
<br>
Will you care?<br>
<br>
Not saying now that exploit known they wouldn't run with it.<br>
<br>
But patching is simplistic.<br>
<br>
I take your point about SSL keys - IF it was in the data returned.<br>
<br>
But with properly isolated systems, it should only be the front end impacted. On the assumption that nobody inside your firewall is exploiting it.<br>
<br>
Lots of IFs all around.<br>
<br>
But I take your point.<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
On 14-04-11 05:44 PM, Bob Jonkman wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
If your router is accessible from the WAN port via http then you have<br>
more urgent problems than Heartbleed.<br>
<br>
If a site has both http and https then there's no (new) vulnerability<br>
with http, but a Heartbleed attack on https can still extract<br>
passwords and other info.<br>
<br>
To extract a password from an http session a bad guy needs to be a<br>
man-in-the-middle, or sniffing the network (remember Firesheep?). To<br>
extract a password with Heartbleed an attacker only has to initiate an<br>
https session.<br>
<br>
- --Bob.<br>
<br>
<br>
<br>
On 14-04-11 05:35 PM, Khalid Baheyeldin wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
But, wouldn't Heartbleed be an issue, only if you use SSL on the<br>
site? For example, if you have OpenWRT/Tomato/DD-WRT and logging<br>
via http (not https), then there is no exploit via OpenSSL?<br>
<br>
<br>
On Fri, Apr 11, 2014 at 3:26 PM, Bob Jonkman <<a href="mailto:bjonkman@sobac.com" target="_blank">bjonkman@sobac.com</a>><br>
wrote:<br>
<br>
If you're using a tool to check for Heartbleed vulnerabilities, be<br>
sure to check the Web interface on your router and/or modem as<br>
well.<br>
<br>
I'm not sure if router vendors are on top of this, but according<br>
to ssltest.py my Tomato/MLPPP Version 1.25-mp3alpha6 (from<br>
<a href="http://fixppp.org" target="_blank">http://fixppp.org</a> ) is not vulnerable, nor my Thomson Speedtouch<br>
modem with firmware 6.1.0.5<br>
<br>
Also, somebody asked me how safe these vulnerability checking<br>
tools are, especially the online and Javascript-based ones. What's<br>
to say they're not merely displaying "all is well", and actually<br>
compiling a list of vulnerable sites for later exploitation?<br>
<br>
--Bob.<br>
<br>
<br>
On 14-04-08 12:06 PM, Khalid Baheyeldin wrote:><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
You can use this python tool ssltest.py to check if your<br>
servers are vulnerable:<br>
<br>
$ wget -O ssltest.py "<a href="http://pastebin.com/raw.php?i=WmxzjkXJ" target="_blank">http://pastebin.com/raw.php?<u></u>i=WmxzjkXJ</a>"<br>
$ python ssltest.py <a href="http://example.com" target="_blank">example.com</a><br>
</blockquote></blockquote></blockquote>
<br>
<br>
On 14-04-11 10:51 AM, CrankyOldBugger wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Mashable has a list going of sites affected by Heartbleed:<br>
<br>
<a href="http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/" target="_blank">http://mashable.com/2014/04/<u></u>09/heartbleed-bug-websites-<u></u>affected/</a><br>
<br>
<br>
<br>
</blockquote></blockquote></blockquote></blockquote>
Don't forget to add Canada Revenue (and most other government<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
sites) to your list of passwords to change!<br>
</blockquote></blockquote></blockquote>
<br>
<br>
<br>
Bob Jonkman <<a href="mailto:bjonkman@sobac.com" target="_blank">bjonkman@sobac.com</a>> Phone: <a href="tel:%2B1-519-669-0388" value="+15196690388" target="_blank">+1-519-669-0388</a><br>
SOBAC Microcomputer Services <a href="http://sobac.com/sobac/" target="_blank">http://sobac.com/sobac/</a><br>
<a href="http://bob.jonkman.ca/blogs/" target="_blank">http://bob.jonkman.ca/blogs/</a> <a href="http://sn.jonkman.ca/bobjonkman/" target="_blank">http://sn.jonkman.ca/<u></u>bobjonkman/</a><br>
Software --- Office & Business Automation --- Consulting<br>
GnuPG Fngrprnt:04F7 742B 8F54 C40A E115 26C2 B912 89B0 D2CC E5EA<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<br>
______________________________<u></u>_________________ kwlug-disc<br>
mailing list <a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a><br>
<a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" target="_blank">http://kwlug.org/mailman/<u></u>listinfo/kwlug-disc_kwlug.org</a><br>
<br>
</blockquote>
<br>
<br>
<br>
<br>
<br>
______________________________<u></u>_________________ kwlug-disc mailing<br>
list <a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a><br>
<a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" target="_blank">http://kwlug.org/mailman/<u></u>listinfo/kwlug-disc_kwlug.org</a><br>
<br>
</blockquote>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.14 (GNU/Linux)<br>
Comment: Ensure confidentiality, authenticity, non-repudiability<br>
<br>
iEYEARECAAYFAlNIYh8ACgkQuRKJsN<u></u>LM5erCjgCfZAuLyG8v83bORUxPxTvs<u></u>14m+<br>
r8kAoInhKmR99uQBN2cIt+<u></u>2KY3xq4KMl<br>
=6dTX<br>
-----END PGP SIGNATURE-----<br>
<br>
<br>
______________________________<u></u>_________________<br>
kwlug-disc mailing list<br>
<a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a><br>
<a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" target="_blank">http://kwlug.org/mailman/<u></u>listinfo/kwlug-disc_kwlug.org</a><br>
<br>
</blockquote>
<br>
<br>
______________________________<u></u>_________________<br>
kwlug-disc mailing list<br>
<a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a><br>
<a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" target="_blank">http://kwlug.org/mailman/<u></u>listinfo/kwlug-disc_kwlug.org</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Khalid M. Baheyeldin<br><a href="http://2bits.com" target="_blank">2bits.com</a>, Inc.<br>Fast Reliable Drupal<br>Drupal optimization, development, customization and consulting.<br>
Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br>Simplicity is the ultimate sophistication. -- Leonardo da Vinci<br>For every complex problem, there is an answer that is clear, simple, and wrong." -- H.L. Mencken<br>
</div>