Heartbleed OpenSSL bug

[Kiril Varbanov]

Hi tech community,

Some of you may have been made aware, but others may be not. Recently there was a pretty nasty bug discovered in OpenSSL's implementation, which poses quite a security risk to any online entity that was relying on it.
The technical details are at the bottom of the post, as well as short analysis, but Mashable has a list of passwords you may need to change right now, although some are in the "better safe than sorry" realm - http://mashable.com/2014/04/09/heartble ... -affected/

What is it?
There's a tiny vulnerability in the code that handles TLS 'heartbeat' messages. By abusing this mechanism, an attacker can request that a running TLS server hand over a relatively large slice (up to 64KB) of its private memory space. Since this is the same memory space where OpenSSL also stores the server's private key material, an attacker can potentially obtain:

1. Long-term server private keys
2. TLS session keys
3. Confidential data, like passwords
4. Session ticket keys

Any of the above may allow an attacker to decrypt ongoing TLS sessions or steal useful information. However item (a) above is by far the worst, since an attacker who obtains the server's main private keys can potentially decrypt past sessions (if made using the non-PFS RSA handshake) or impersonate the server going forward. Worst of all, the exploit leaves no trace.

While the issue itself was introduced with 20 lines of erroneous code, we cannot be mad at the OpenSSL community, which is relatively small and works with essentially no pay.

P.S. I laughed hard at the late night news yesterday claiming a global hacker attack has been initiated and we need to save ourselves ASAP. Nothing like that, really. Don't panic, just the next wave of pro-active password changes.

[the EDGE]

Thanks

But how would changing you password help?

Would you not need to change it every time you went on-line, even then would you still not be vanurable?

[Kiril Varbanov]

Thanks

But how would changing you password help?

Would you not need to change it every time you went on-line, even then would you still not be vanurable?

It's a more of precautionary measure, in case an attacker has already obtained something. That is, raw 64k raw blocks of data which he has to analyze and stitch together, unless he's OK with some scrambled numbers and letters.

Supposedly the sites have already patched the vulnerability and now we have the public disclosure. The more I get into this, the more I'm convinced it's dating back in November. But anyway, some companies do not take security seriously to the moment when they are damaged seriously.

[markc]

The bug could potentially allow access to the private keys. With these keys any data transmitted with the public key can be decrypted - so its like you're not using some form of secure transmission.

It's like Enigma and the Ultra program. Enigma was used by the Germans to encrypt communications, and the cypher was supposedly unbreakable. The Ultra program cracked the codes and the process became so refined that the Allies were reading messages to German high command (Hitler even) before they were. The implication there is they could also SEND communications...

Why do you need to change your password? Because the potential, as defined above, is that they already know your username and email address password combination. It is known that most people use the same password and email combination for many sites therefore once they've got one they can gain access to your email and then access to all your accounts. Why do they want facebook? So they can like lots of crap and make money.

While I'm on this crusade, PLEASE don't use easy passwords. I URGE you to use pass phrases such as this: WIotc,Pduep. That password is the first letters and punctuation of the first sentence of this paragraph. That is a VERY secure password, and as long as you can remember the phrase you're safe. The implication there is: don't use easy phrases, such as song lyrics, books etc.

Security is only as strong as the weakest link!