Holy $#&$*!! Heartbleed. Catastrophic bug in OpenSSL.

[joshcryer]

Heartbleed
Basically, an attacker can grab 64K of memory from a server. The attack leaves no trace, and can be done multiple times to grab a different random 64K of memory. This means that anything in memory -- SSL private keys, user keys, anything -- is vulnerable. And you have to assume that it is all compromised. All of it.

Critical crypto bug in OpenSSL opens two-thirds of the Web to eavesdropping
Researchers have discovered an extremely critical defect in the cryptographic software library an estimated two-thirds of Web servers use to identify themselves to end users and prevent the eavesdropping of passwords, banking credentials, and other sensitive data.

The warning about the bug in OpenSSL coincided with the release of version 1.0.1g of the open-source program, which is the default cryptographic library used in the Apache and nginx Web server applications, as well as a wide variety of operating systems and e-mail and instant-messaging clients. The bug, which has resided in production versions of OpenSSL for more than two years, could make it possible for people to recover the private encryption key at the heart of the digital certificates used to authenticate Internet servers and to encrypt data traveling between them and end users. Attacks leave no traces in server logs, so there's no way of knowing if the bug has been actively exploited. Still, the risk is extraordinary, given the ability to disclose keys, passwords, and other credentials that could be used in future compromises.

Two thirds of the entire internet. Wow.

[Egnever]

1. An interesting bug. The hype is a little over blown IMHO most of the big sites are fine.

https://github.com/musalbas/heartbleed-masstest/blob/master/top1000.txt

That is a partial listing of vulnerable sites, also a partial listing of safe sites and if you look at the safe ones most of the big guys are fine.

If you have the same password across many sites you should definitely change them.

[joshcryer]

3. The bug has existed for two whole years though.

It helps explain how the NSA got access to FB private chats, imo.

[Egnever]

5. Yea

But it doesn't affect all SSL only certain versions. The FAQ is an interesting read.


http://heartbleed.com/

[ManiacJoe]

2. Lots of previous threads:

http://www.democraticunderground.com/1014775406
http://www.democraticunderground.com/1014775979
http://sync.democraticunderground.com/10024800506

[joshcryer]

4. Thanks, it was news to me.

I couldn't believe it. A two year old bug... that basically has compromised the entire internet.

[blkmusclmachine]

6. ,

,

[RoccoR5955]

7. meh!

The latest cyber-hype. Anyone who manages a server knows not to use such old tools.
Besides, many coders have already fixed it.
So what the clueless user should do is to not use their financial websites until Saturday.
When Saturday rolls around, go to all of your financial sites, and change your damn password.
Make it a strong password. "Password" is NOT a password. Neither are these other 499: http://www.whatsmypass.com/the-top-500-worst-passwords-of-all-time
So there is not much need for alarm, just watch your financials, if you don't already do so.
As a matter of fact, it wouldn't be a bad time to change ALL of your passwords, and don't use the same one twice.
For more info on how to make up good passwords look here: http://www.makeuseof.com/tag/create-strong-password-forget/

Take it from someone with almost 30 years of computer/network experience.

[joshcryer]

8. Old tools? 1.0.1g was released recently...

OpenSSL was highly compromised... for two years. How did the NSA get HTTPS / ssl protected FB chats? This is the only way.

[RoccoR5955]

9. Yep!

They probably built the hole into it themselves!

[L0oniX]

10. +1

[uponit7771]

12. +1

[L0oniX]

11. Maybe the latest OpenSSL has NSA/gov access and this is all to get everyone to move to the new one.

[PasadenaTrudy]

13. They always say not to

write down your passwords, but I have to keep a notebook with them handy. I make up very random passwords, write them down along with the date I changed it. Also, if/when I croak, it will help my loved ones. It's just my home laptop, no work computers.

[Blue_Tires]

14. Has anyone gotten around to pinning this to the NSA yet?