Topic: How serious is the heart bleed bug?
Anonymous A started this discussion 12 years ago #34,341
I saw Mojang made an announcement on their website and then I saw it on the news.
Both cases gave me a fright.
How serious is this virus?
Both cases gave me a fright.
How serious is this virus?
dw !jdTkvovFCQ joined in and replied with this 12 years ago, 8 minutes later[^] [v] #474,034
squeegee !first/o5zA joined in and replied with this 12 years ago, 6 minutes later, 15 minutes after the original post[^] [v] #474,035
just change your passwords
Anonymous A (OP) replied with this 12 years ago, 7 minutes later, 22 minutes after the original post[^] [v] #474,036
@previous (squeegee !first/o5zA)
According to /g/, this doesn't make you secure unless the website has the newest version of OpenSSL.
According to /g/, this doesn't make you secure unless the website has the newest version of OpenSSL.
squeegee !first/o5zA replied with this 12 years ago, 1 minute later, 23 minutes after the original post[^] [v] #474,037
Anonymous D joined in and replied with this 12 years ago, 4 hours later, 4 hours after the original post[^] [v] #474,057
> openSSL
im dyin laughing
im dyin laughing
Anonymous E joined in and replied with this 12 years ago, 11 hours later, 15 hours after the original post[^] [v] #474,092
Yet Another Buffer Overflow Attack...
... YABOA.
... YABOA.
r04r joined in and replied with this 12 years ago, 5 minutes later, 15 hours after the original post[^] [v] #474,094
First of all, it's not a virus. It's like http://heartbleed.com/ says a serious vulnerability in the popular OpenSSL cryptographic software library. This means that almost every website which uses HTTPS - and a whole load of other services, like IRC servers that have SSL enabled, etc - have a pretty serious bug in them. The same goes for clients that use OpenSSL, like some IRC clients when connecting to SSL-enabled servers. Notably, most web browsers are not affected because they do not use OpenSSL, instead they use NSS, GnuTLS or something else which did not include the bug.
The bug itself can be exploited by the connecting party during the handshake, right at the start of the connection. So an evil IRC server could trigger the bug in your IRC client, for example. Or more seriously, anyone with some https://gist.github.com/sh1n0b1/10100394 can exploit (web) servers affected by the bug.
When exploited, the bug will give the attacker the contents of 64KB of memory of the server. This may not seem like a lot, but it can be done repeatedly and it is generally the area of the 'stack', which includes all recent data that had been recently handled. In the case of a webserver, that would be cookies or web traffic that came by recently, which could easily contain your password during a login attempt, or your cookies from any connection. This is pretty bad.
So yeah, it is a good idea to change your password on any and all websites that you deem important, and assume that your passwords are known. You can test if a website is still vulnerable using the earlier linked python script or any of the following websites:
- http://filippo.io/Heartbleed/
- http://possible.lv/tools/hb/
- https://lastpass.com/heartbleed/
The bug itself can be exploited by the connecting party during the handshake, right at the start of the connection. So an evil IRC server could trigger the bug in your IRC client, for example. Or more seriously, anyone with some https://gist.github.com/sh1n0b1/10100394 can exploit (web) servers affected by the bug.
When exploited, the bug will give the attacker the contents of 64KB of memory of the server. This may not seem like a lot, but it can be done repeatedly and it is generally the area of the 'stack', which includes all recent data that had been recently handled. In the case of a webserver, that would be cookies or web traffic that came by recently, which could easily contain your password during a login attempt, or your cookies from any connection. This is pretty bad.
So yeah, it is a good idea to change your password on any and all websites that you deem important, and assume that your passwords are known. You can test if a website is still vulnerable using the earlier linked python script or any of the following websites:
- http://filippo.io/Heartbleed/
- http://possible.lv/tools/hb/
- https://lastpass.com/heartbleed/
(Edited 30 minutes later.)
r04r double-posted this 12 years ago, 23 seconds later, 15 hours after the original post[^] [v] #474,095
@474,092 (E)
It's a (lacking) bounds check, not really a buffer overflow.
edit: Buffer overflows tend to lead to code execution, this is luckily just information diclosure
It's a (lacking) bounds check, not really a buffer overflow.
edit: Buffer overflows tend to lead to code execution, this is luckily just information diclosure
(Edited 2 minutes later.)
Killer Lettuce !!iNo3FkiZx joined in and replied with this 12 years ago, 4 hours later, 19 hours after the original post[^] [v] #474,115
@474,094 (r04r)
So I should be careful whom I shake hands with? You said that this thing goes down during handshakes. Okay, then I'll only shake hands with people I trust whilst Mojang fixes this. Thanks for the tip, bud.
So I should be careful whom I shake hands with? You said that this thing goes down during handshakes. Okay, then I'll only shake hands with people I trust whilst Mojang fixes this. Thanks for the tip, bud.
r04r replied with this 12 years ago, 2 minutes later, 20 hours after the original post[^] [v] #474,118
@previous (Killer Lettuce !!iNo3FkiZx)
You have nothing to worry about in regards to mojang, since minecraft is java and java implements its own SSL stack, and doesn't use OpenSSL. Their servers could've been twatted, though. But they are on Amazon Web Services and they have since been patched.
You have nothing to worry about in regards to mojang, since minecraft is java and java implements its own SSL stack, and doesn't use OpenSSL. Their servers could've been twatted, though. But they are on Amazon Web Services and they have since been patched.
Killer Lettuce !!iNo3FkiZx replied with this 12 years ago, 7 minutes later, 20 hours after the original post[^] [v] #474,121
r04r replied with this 12 years ago, 9 minutes later, 20 hours after the original post[^] [v] #474,123
Anonymous H joined in and replied with this 12 years ago, 58 minutes later, 21 hours after the original post[^] [v] #474,138
r04r replied with this 12 years ago, 18 hours later, 1 day after the original post[^] [v] #474,273
http://xkcd.com/1354/TTEH !JXsxEkDBLs joined in and replied with this 12 years ago, 14 minutes later, 1 day after the original post[^] [v] #474,275
Ks !KansasxqvM joined in and replied with this 12 years ago, 12 minutes later, 1 day after the original post[^] [v] #474,277
@474,094 (r04r)
Great explanation.
Someone should write a heartbleed notifier, if the site suffers from the bug don't login etc.
Great explanation.
Someone should write a heartbleed notifier, if the site suffers from the bug don't login etc.
TTEH !JXsxEkDBLs replied with this 12 years ago, 8 minutes later, 1 day after the original post[^] [v] #474,279
r04r replied with this 12 years ago, 2 minutes later, 1 day after the original post[^] [v] #474,280
@474,275 (TTEH !JXsxEkDBLs)
It is!
@474,277 (Ks !KansasxqvM)
I know LastPass did this, but you have to actually use their product. It also seems like one exists for chrome: https://chrome.google.com/webstore/detail/chromebleed/eeoekjnjgppnaegdjbcafdggilajhpic
It is!
@474,277 (Ks !KansasxqvM)
I know LastPass did this, but you have to actually use their product. It also seems like one exists for chrome: https://chrome.google.com/webstore/detail/chromebleed/eeoekjnjgppnaegdjbcafdggilajhpic
TTEH !JXsxEkDBLs replied with this 12 years ago, 1 minute later, 1 day after the original post[^] [v] #474,281
@474,277 (Ks !KansasxqvM)
Looks like there is one for FF too: https://addons.mozilla.org/en-US/firefox/addon/heartbleed-checker/
Luckily most major sites have long fixed this. Not many seem to be recommending resetting passwords, though I think Yahoo did.
Looks like there is one for FF too: https://addons.mozilla.org/en-US/firefox/addon/heartbleed-checker/
Luckily most major sites have long fixed this. Not many seem to be recommending resetting passwords, though I think Yahoo did.
r04r replied with this 12 years ago, 4 minutes later, 1 day after the original post[^] [v] #474,282
@previous (TTEH !JXsxEkDBLs)
I feel like there's been suprisingly little mainstream media coverage of this, but maybe I just missed it. I guess it's hard to dumb down.
I feel like there's been suprisingly little mainstream media coverage of this, but maybe I just missed it. I guess it's hard to dumb down.
TTEH !JXsxEkDBLs replied with this 12 years ago, 12 minutes later, 1 day after the original post[^] [v] #474,285
@previous (r04r)
Yeah, I think it warrants a lot more attention than it's getting. Here, it was the top BBC story for a little while, in the form of "Users urged to reset all passwords", then it died down and I haven't heard about it since. Sky News didn't give it much coverage. The Daily Mail are probably working out a way to blame immigrants.
Also the amount of stories calling it a "virus" and trying to somehow involve China is ridiculous.
Yeah, I think it warrants a lot more attention than it's getting. Here, it was the top BBC story for a little while, in the form of "Users urged to reset all passwords", then it died down and I haven't heard about it since. Sky News didn't give it much coverage. The Daily Mail are probably working out a way to blame immigrants.
Also the amount of stories calling it a "virus" and trying to somehow involve China is ridiculous.
(Edited 1 minute later.)
Ks !KansasxqvM replied with this 12 years ago, 54 seconds later, 1 day after the original post[^] [v] #474,286
@474,280 (r04r)
What are your thoughts on LastPass? Do you use it and recommend it? I don't know enough about the subject to make an informed decision - consequently I've never used the product.
What are your thoughts on LastPass? Do you use it and recommend it? I don't know enough about the subject to make an informed decision - consequently I've never used the product.
r04r replied with this 12 years ago, 3 minutes later, 1 day after the original post[^] [v] #474,287
@previous (Ks !KansasxqvM)
I don't use it and don't like the idea of storing my passwords on someone elses server. I use KeePass with FTP sync on my own server, but if all your devices support dropbox you can use something like that. The reason I'm ok with storing my keepass file on someone else's server is because I know keepass employs strong encryption client-side and they are open source.
I don't use it and don't like the idea of storing my passwords on someone elses server. I use KeePass with FTP sync on my own server, but if all your devices support dropbox you can use something like that. The reason I'm ok with storing my keepass file on someone else's server is because I know keepass employs strong encryption client-side and they are open source.
(Edited 5 minutes later.)
Anonymous H replied with this 12 years ago, 4 hours later, 1 day after the original post[^] [v] #474,321
@474,285 (TTEH !JXsxEkDBLs)
> The Daily Mail are probably working out a way to blame immigrants.
lol'd
> The Daily Mail are probably working out a way to blame immigrants.
lol'd
Syntax joined in and replied with this 12 years ago, 29 minutes later, 1 day after the original post[^] [v] #474,324
@474,282 (r04r)
Was covered by CNN multiple tymes. - a sampling of a few
http://thelead.blogs.cnn.com/2014/04/11/report-nsa-knew-about-heartbleed-bug/
Video is different from the coverage I viewed.
http://www.cnn.com/2014/04/09/opinion/wisniewski-heartbleed-bug-endangers-all/
http://money.cnn.com/2014/04/09/technology/security/heartbleed-bug/
Was covered by CNN multiple tymes. - a sampling of a few
http://thelead.blogs.cnn.com/2014/04/11/report-nsa-knew-about-heartbleed-bug/
Video is different from the coverage I viewed.
http://www.cnn.com/2014/04/09/opinion/wisniewski-heartbleed-bug-endangers-all/
http://money.cnn.com/2014/04/09/technology/security/heartbleed-bug/
Anonymous H replied with this 12 years ago, 1 hour later, 1 day after the original post[^] [v] #474,328
@previous (Syntax)
Please copy and paste the entire Wikipedia article about Heartbleed so we can read it
Please copy and paste the entire Wikipedia article about Heartbleed so we can read it