Heartbleed Bug - The Diigo Meta page

• 10 May 16
  

  Jim Konstan

  tech

• 14 Aug 15
  

  sungwook128
  • The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library.
  • The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library.
  • weakness
  • stealing the information protected
  • SSL/TLS encryption used to secure the Internet
  • under normal conditions
  • SSL/TLS
  • communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).
  • The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software.

  7 more annotations...

• 

  jpark0415
  • a serious vulnerability in the popular OpenSSL cryptographic software library
  • a serious vulnerability in the popular OpenSSL cryptographic software library.
  • allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software.

  1 more annotation...

• 13 Jun 15
  

  jbelback

  IFTTT Delicious security heartbleed

• 27 Jan 15
  

  Chris Casab

  The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.

  security openssl Heartbleed bug ssl

• 23 Sep 14
  

  javid_gs2
  • As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.

  • What makes the Heartbleed Bug unique?

     

    Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.
• 22 Jul 14
  

  robert0714

  Heartbleed

  • The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library.
• 12 Jul 14
  

  derrickjones19
• 08 May 14
  

  luis sawyer

  hacking

• 06 May 14
  

  lcalder1

  security Heartbleed bug vulnerability exploit

  • The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
• 30 Apr 14
  

  Jene Enejo

  Heartbleed sekureco security

• 26 Apr 14
  

  redshirt2014

  "op the leak"

• 23 Apr 14
  

  Kelly Koplitz

  Bugs

• 22 Apr 14
  

  Ricky Kurniawan

  The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

  security openssl webdeveloper Heartbleed webdevelopment bug ssl vulnerability exploit tls

• 20 Apr 14
  

  Kazuhito Kidachi

  "The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet."

  security

• 17 Apr 14
  

  oscaryl_uni

  heartbleed ssl grieta seguridad internet noticias

• 16 Apr 14
  

  squalter

  heartbleed

• 

  nikbox

  security openssl ssl exploit vulnerability tls bug Heartbleed

• 

  Eric Villard
• 15 Apr 14
  

  Grace Kat

  security Heartbleed

• 

  elurie
• 

  Scott

  security openssl Heartbleed bug ssl vulnerability exploit

• 14 Apr 14
  

  Pauliina Mäkelä

  heartbleed bug internet web software delicious

• 

  stijn_gunst
  • n used to secure the Internet. SSL/TLS provides co
• 

  Rob Shakespeare

  security openssl Heartbleed bug ssl vulnerability exploit tls

• 

  dascalb

  "The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. "

  security openssl Heartbleed bug vulnerability tls articol idee blog

• 

  Olivier Tripet

  heartbleed reference security hacking

• 

  Kazuhiko Kato
• 

  abol tabol

  Heartbleed

• 13 Apr 14
  

  sperrez
• 

  Soumya Kundu

  heartbleed openssl

• 

  Tano San

  exploit vulnerability

• 

  Michael Tiller

  security

• 12 Apr 14
  

  Paul Heering

  "Heartbleed Bug"

  heartbleed security

• 11 Apr 14
  

  Daniel Bryant

  security openssl bug Heartbleed

• 

  Karin Beil

  Heartbleed bug security virus

• 

  Ethan Brown

  ssl security vulnerability

• 

  Oliver Kurz

  Internet Sicherheit security SSL crypto Wissen FAQ Heartbleed

• 

  security software heartbleed heartbeat

• 

  Mark Marino

  security critcode virus heartbleed

• 

  Hiroto Kagotani

  ssl security bug

• 10 Apr 14
  

  Fer B R

  desarrolloweb

• 

  Aya Sherlocat
• 

  agentmilindu
• 

  Bill Campbell

  security heartbleed

• 

  Christian D

  openssl security bug ssl vulnerability exploit

• 

  tipsypittsy

  haertbleed

• 

  arcojedi

  The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs). The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

  technology_security technology_software_security technology_software web-developer_ssl web-developer web-developer_tools technology_software_open-source imported

• 

  Herbert RL

  security bug ssl vulnerability exploit

• 

  Edmond Lau

  security bug

• 

  OpenSSL SSL Bug Heartbleed

• 

  Ivan Tishchenko

  zp-EagleEye zp-cb security issue

• 

  Phil Taylor

  openssl security Heartbleed vulnerability exploit

• 

  yoav85

  @yoav85 קישורים:
  http://t.co/NsL49Ke7Da
  
  http://t.co/S49FJ6bbHk

  twitter.favs

• 

  Marco Bruni
• 

  Katya Mercurio

  vulnerability Heartbleed openssl security

  • This Q&A was published as a follow-up to the OpenSSL advisory, since this vulnerability became public on 7th of April 2014. The OpenSSL project has made a statement at https://www.openssl.org/news/secadv_20140407.txt. NCSC-FI published an advisory at https://www.cert.fi/en/reports/2014/vulnerability788210.html.
• 

  bmeuwis

  heartbleed openssl

• 

  Yogi Golle

  openssl security bug

• 09 Apr 14
  

  r3d33m3r

  OpenSSL security_vulnerability

• 

  Anthony Kendall

  "The Heartbleed Bug"

  openssl security Heartbleed ssl bug vulnerability exploit tls

  • The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

     

    The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
• 

  MITRE

  openssl security bug Heartbleed ssl tls exploit vulnerability

• 

  Russ Johnson

  openssl security Heartbleed exploit

• 

  Pablo Fernández Mena

  If you are running OpenSSL on your servers, please make sure to fix The Heartbleed Bug as soon as possible. http://t.co/HXCWcLBhXZ

• 

  Holger Hubbs

  ssl security

• 

  linekin
• 

  Phil Piotrowski

  openssl vulnerability bug heartbleed

• 

  Laurie Villwock

  privacy

• 

  Tom Raftery

  RT @timoreilly: As always, @xkcd covers the news with unique aplomb http://t.co/x6q3IJnlza (In this case, heartbleed http://t.co/EjEaHhF3nz

  via:packrati.us

• 

  acazsouza

  security openssl ssl vulnerability bug software encryption heartbleed heartbeat tls programming code

• 

  afsdedanaan

  "detect"

  Heartbleed bug openssl security password

• 

  Sam Rose

  openssl bug Heartbleed

• 

  dan mcquillan

  ssl opensource bug vulnerability heartbleed

• 

  giannis skitsas
• 

  Nisim Joseph

  OpenSSL

• 

  fredcai
  • This is implementation problem
  • OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
  • Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

  1 more annotation...

• 

  Gilles d'Arco

  OpenSSL Vulnerability

• 

  Philip Johnson

  "The Heartbleed Bug
  
  The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).
  
  The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
  Heartbleed Bug
  What leaks in practice?
  
  We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.
  How to stop the leak?
  
  As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use."

  openssl security bug ssl exploit tls heartbleed april 2014

• 

  Hiroki Uchida
• 

  Jesse Emond

  heartbleed bug openssl security heartbeat

• 

  c rb
• 

  Dexter Chun

  Heartbleed ssl tls security openssl

• 

  Keisuke Mori

  openssl security

• 

  Hiroaki Nakamura

  openssl heartbleed vulnerability

• 

  Michael Feher
• 

  David Chaves

  openssl bug security ssl tls programming

• 08 Apr 14
  

  Alessandro Metta
• 

  Thierry Henrio

  cryptography security awesome exploit

• 

  Todd Zimmerman
• 

  Grzegorz Wierzowiecki

  security openssl

• 

  Maxime Cyr

  The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.

  heartbleed bug openssl security ssl

• 

  Ed Dodds

  Heartbleed Bug

• 

  salrodriguez
  • lows stealing the information protect
  • ypt the traffic, the names and passwords of the users and the actual conte
  • endors have to adopt the fix and notify their use
  • rogramming mis
  • eissuing and redistributing new key
  • our popular social site, your company's site, commerce site, hobby site, site you install software from or even sites run by your government might be using vulnerable OpenSS
  • ve sites on the Internet was over 66% acco
  • been out there for over two years n
  • on of this bug leaves no traces of

  • s this been abused in the wild?

     

    We don't kn
  • ineers (Riku, Antti and Matti) at Codenomicon and Neel Mehta of Google Secur

  9 more annotations...

• 

  makelseyca

  security

• 

  R Mills

  bug security Heartbleed technology computer

• 

  georgm

  OpenSSL Security Leak Bugs SSL TLS Software Vulnerablities Encryption

• 

  Markdown .
• 

  Peter Burkholder

  openssl Heartbleed ssl security tls

• 

  Greg Lloyd

  8 Apr 2014: The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

  Heartbleed OpenSSL crypto bug resources

  • How to stop the leak?

     

    As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.

  • What leaks in practice?

     

    We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

  • What is the CVE-2014-0160?

     

    CVE-2014-0160 is the official reference to this bug. CVE (Common Vulnerabilities and Exposures) is the Standard for Information Security Vulnerability Names maintained by MITRE. Due to co-incident discovery a duplicate CVE, CVE-2014-0346, which was assigned to us, should not be used, since others independently went public with the CVE-2014-0160 identifier.

      

  • Why it is called the Heartbleed Bug?

     

    Bug is in the OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.

  • What makes the Heartbleed Bug unique?

     

    Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.

  • What is being leaked?

     

    Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories: 1) primary key material, 2) secondary key material and 3) protected content and 4) collateral.

  • What is leaked primary key material and how to recover?

     

    These are the crown jewels, the encryption keys themselves. Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. All this has to be done by the owners of the services.

  • What is leaked secondary key material and how to recover?

     

    These are for example the user credentials (user names and passwords) used in the vulnerable services. Recovery from this leaks requires owners of the service first to restore trust to the service according to steps described above. After this users can start changing their passwords and possible encryption keys according to the instructions from the owners of the services that have been compromised. All session keys and session cookies should be invalided and considered compromised.

  • Recovery sounds laborious, is there a short cut?

     

    After seeing what we saw by "attacking" ourselves, with ease, we decided to take this very seriously. We have gone laboriously through patching our own critical services and are in progress of dealing with possible compromise of our primary and secondary key material. All this just in case we were not first ones to discover this and this could have been exploited in the wild already.

  • How revocation and reissuing of certificates works in practice?

     

    If you are a service provider you have signed your certificates with a Certificate Authority (CA). You need to check your CA how compromised keys can be revoked and new certificate reissued for the new keys. Some CAs do this for free, some may take a fee.

      

  • What versions of the OpenSSL are affected?

     

    Status of different versions:

      
     
    • OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
     
    • OpenSSL 1.0.1g is NOT vulnerable
     
    • OpenSSL 1.0.0 branch is NOT vulnerable
     
    • OpenSSL 0.9.8 branch is NOT vulnerable
  • Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

  • How about operating systems?

     

    Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:
  • • ebian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
     
    • Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
     
    • CentOS 6.5, OpenSSL 1.0.1e-15
     
    • Fedora 18, OpenSSL 1.0.1e-4
     
    • OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
     
    • FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
     
    • NetBSD 5.0.2 (OpenSSL 1.0.1e)
     
    • OpenSUSE 12.2 (OpenSSL 1.0.1c)

  • Operating system distribution with versions that are not vulnerable:

      
     
    • Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
     
    • SUSE Linux Enterprise Server
     
    • FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013
     
    • FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013
     
    • FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

  • Can I detect if someone has exploited this against me?

     

    Exploitation of this bug leaves no traces of anything abnormal happening to the logs.

      

  • Does Perfect Forward Secrecy (PFS) mitigate this?

     

    Use of Perfect Forward Secrecy (PFS), which is unfortunately rare but powerful, should protect past communications from retrospective decryption. Please see https://twitter.com/ivanristic/status/453280081897467905 how leaked tickets may affect this.

  15 more annotations...

• 

  breadtan

  "Most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66% according to Netcraft's April 2014 Web Server Survey. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. "

• 

  Manuel Polo

  openssl security bug ssl

Would you like to comment?

Join Diigo for a free account, or sign in if you are already a member.