Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL.org hacked?

openssl.org

Post reply on HN
Print view View original

11–20 of 98 posts

Re: OpenSSL.org hacked?

#11

Post by 0x0 »

rhgraysonii wrote: post #9

Forgive me for the ignorance but why is this significant if at all? Honestly curious, not being facetious.

If they can replace the front page html, they could probably also replace the source code distribution with a backdoored/trojaned tarball. Or someone else might already have done so, since who knows how long ago, using the same exploit.

Re: OpenSSL.org hacked?

#12

Post by gcr »

rhgraysonii wrote: post #9

Forgive me for the ignorance but why is this significant if at all? Honestly curious, not being facetious.

This shows that website security depends on far more than just deploying over SSL.

Re: OpenSSL.org hacked?

#17

Post by devdoomari »

sillysaurus2 wrote: post #8
zaroth wrote: post #4

I tend not to click on links advertising pages that are hacked. You know, not that many zero days on Chrome, but still seems like a risky click, as they say.

$ curl www.openssl.org TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _

but what if they set-up the server side so that the server returns different results depending on the browser/OS?

Re: OpenSSL.org hacked?

#18

Post by jrockway »

babuskov wrote: post #10
zaroth wrote: post #4

I tend not to click on links advertising pages that are hacked. You know, not that many zero days on Chrome, but still seems like a risky click, as they say.

You can always run browser in a vitrual machine. Or open it with a text browser like Lynx or Links. Or use wget to download the file and read in text editor.

But what if the page uses HTML5 audio to "jump the gap" and reprogram all nearby electronic devices to attack you on 1/1/2014!?

Re: OpenSSL.org hacked?

#19

Post by dangrossman »

devdoomari wrote: post #17
sillysaurus2 wrote: post #8

Earlier quoted context omitted.

$ curl www.openssl.org TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _

but what if they set-up the server side so that the server returns different results depending on the browser/OS?

    $ curl -A "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36" www.openssl.org
Post reply on HN