Heartbleed bug

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Apr 09, 2014 4:42 pm

Just wondering really, is the media blowing this out of proportion or is it as bad as they are saying?

According to the BBC we should change every password we currently have?

http://www.bbc.co.uk/news/technology-26954540

Is it seriously that big of a bug?

Posted: Wed Apr 09, 2014 6:07 pm

Its pretty serious. This article gives a much better explanation as to why its such a big deal.

Quote:

The problem is fairly simple: there's a tiny vulnerability -- a simple missing bounds check -- in the code that handles TLS 'heartbeat' messages. By abusing this mechanism, an attacker can request that a running TLS server hand over a relatively large slice (up to 64KB) of its private memory space. Since this is the same memory space where OpenSSL also stores the server's private key material, an attacker can potentially obtain (a) long-term server private keys, (b) TLS session keys, (c) confidential data like passwords, (d) session ticket keys

Quote:

Any of the above may allow an attacker to decrypt ongoing TLS sessions or steal useful information. However item (a) above is by far the worst, since an attacker who obtains the server's main private keys can potentially decrypt past sessions (if made using the non-PFS RSA handshake) or impersonate the server going forward. Worst of all, the exploit leaves no trace.

So, an attacker can steal the server private keys and go back and see everything on the server, both old stuff and new stuff as well.

Posted: Wed Apr 09, 2014 6:42 pm

I may go on a PW change-a-thon i think. (once the vulnerability is patched anyway

Posted: Wed Apr 09, 2014 8:20 pm

^^ That's the trick. No use changing anything if the opening persists!!

Posted: Wed Apr 09, 2014 11:35 pm

When I was a boy,they used vinegar and brown paper.

Posted: Thu Apr 10, 2014 12:34 am

As I understand it, the process of stealing the information is also invisible, ie admins wouldn't even know it's happening. Ack.

Posted: Thu Apr 10, 2014 3:07 pm

List of websites affected by this from the BBC with password change advice

http://www.bbc.co.uk/news/technology-26971363

Posted: Thu Apr 10, 2014 3:43 pm

Luckily the only one that counts for me is my Bank and according to that list I have no need to change my PW

As to Google and Yahoo all accounts I have with them are to do with baiting and I am not too bothered with them

Posted: Thu Apr 10, 2014 3:49 pm

More than a little confusing:

Quote:

Google said that logins for its services did not need to be reset unless they were used on other sites.

(Other articles say the same about Gmail.)

Later in the same piece, in the list of major sites:

Quote:

Google/Gmail

(Vulnerable?)
Yes

(Patched?)
Yes

(Change password?)
Yes

Posted: Thu Apr 10, 2014 4:38 pm

^^ i thought that too, im gonna reset all my RL passwords for google to be on the safe side, baiting stuff not bothered with.

luckily for me i dont think anything on that list affects me personally....

Posted: Thu Apr 10, 2014 6:09 pm

I normally change my RL email password often anyway, I realized it's been nearly a year so I was overdue anyway.

Like you I'm not worried about my baiting accounts.

Posted: Thu Apr 10, 2014 6:16 pm

As you might imagine, businesses with sensitive information are flipping out. I work for an airline, so the pile includes our stuff and all sorts of goodies from the Department of Transportation, Homeland Security, TSA, the list goes on and on.

I'm hiding under my desk until the dust clears.

Master of Master Baiters Joined: 13 Jan 2014 Posts: 698

One of my apps, SecureSafe patched a message to say that their site is NOT affected, which is just as well, because that's where I store my passwords, but I have a couple of RL addresses that could be vulnerable.

Posted: Thu Apr 10, 2014 10:51 pm

I use Lastpass, and that was vulnerable till this morning BST. Shocked

There's a URL checker here.

Posted: Fri Apr 11, 2014 7:25 pm

Quote:

I use Lastpass, and that was vulnerable till this morning BST

Might want to read the rest of the blogpost from lastPass

Quote:

How does it affect LastPass?

LastPass utilizes OpenSSL for HTTPS/TLS/SSL encryption and we were therefore “vulnerable” to this bug. For anyone who was using this tool: http://filippo.io/Heartbleed/#lastpass.com to check whether LastPass was vulnerable, it would have shown that we were vulnerable until this morning, when we restarted our servers after the patched OpenSSL software update.

However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern.

Also, LastPass has employed a feature called “perfect forward secrecy”. This ensures that when security keys are changed, past and future traffic also can’t be decrypted even when a particular security key is compromised.

So, yes LP was using an iteration of OpenSSL which had been compromised BUT that does not mean your pw's had need compromised on THEIR server . However, your pw's MAY have been compromised on any other site with the relevant version of OpenSSL.

I really cannot emphasise how important it is to use a good password manager like LassPass, Keepass, Roboform etc.

Set a very strong master password ( 12+ characters) randomised and make sure you keep a copy of that password somewhere safe ( not on a PC/tablet/phone- preferably a piece of paper!). Make sure you use a random password generator with as many characters as possible ( it doesnt matter because you dont have to remember them) and use a unique password for each site needing one.

If you need any more convincing I recommend reading the following article - http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/

Posted: Mon Apr 14, 2014 10:37 am

the best explanation I've seen:

http://xkcd.com/1354/

Yeah, time to change passwords I think...