Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL.org hacked?

openssl.org

Post reply on HN
Print view View original

31–40 of 98 posts

Re: OpenSSL.org hacked?

#31

Post by drdaeman »

jrockway wrote: post #18
babuskov wrote: post #10

Earlier quoted context omitted.

You can always run browser in a vitrual machine. Or open it with a text browser like Lynx or Links. Or use wget to download the file and read in text editor.

But what if the page uses HTML5 audio to "jump the gap" and reprogram all nearby electronic devices to attack you on 1/1/2014!?

Obviously, VM should have no access to audio outputs, display driver should be rewritten to scramble output to be only viewable using a Lenslok-like device and the whole setup should run on a isolated computer staying in a clean room with a dead-man switch installed that - in case of unforeseen consequences - would quickly power a whole apartment down and call for emergency.

Re: OpenSSL.org hacked?

#32

Post by midas007 »

Yet another example of why to both sign release artifacts AND verify them is important.

Also, if you're running the public website for a security lib or core FOSS package, expect more attacks by kiddies trying to build rep... so very conservative tech choices (mostly static website served from a read-only fs) and defensive practices are de rigueur.

Re: OpenSSL.org hacked?

#33

Post by rst »

devdoomari wrote: post #17
sillysaurus2 wrote: post #8

Earlier quoted context omitted.

$ curl www.openssl.org TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _

but what if they set-up the server side so that the server returns different results depending on the browser/OS?

They might be looking for client addresses of specific targets. Then again, if they were trying for a "bank shot" attack on some particular target, they almost certainly wouldn't be trashing the front page to let the world know that the whole site is compromised.

Re: OpenSSL.org hacked?

#34

Post by brianpgordon »

drdaeman wrote: post #31
jrockway wrote: post #18

Earlier quoted context omitted.

But what if the page uses HTML5 audio to "jump the gap" and reprogram all nearby electronic devices to attack you on 1/1/2014!?

Obviously, VM should have no access to audio outputs, display driver should be rewritten to scramble output to be only viewable using a Lenslok-like device and the whole setup should run on a isolated computer staying in a clean room with a dead-man switch installed that - in case of unforeseen consequences - would quickly power a whole apartment down and call for emergency.

I think you're neglecting to consider the possibility of seismic communication by doing a lot of client-side computation to make the CPU fan kick on and off.

Re: OpenSSL.org hacked?

#36

Post by pwnna »

zaroth wrote: post #4

I tend not to click on links advertising pages that are hacked. You know, not that many zero days on Chrome, but still seems like a risky click, as they say.

I clicked and then I realized that I shouldn't have.

Luckily it seemed to have cleared.

Re: OpenSSL.org hacked?

#37

Post by yk »

jrockway wrote: post #18
babuskov wrote: post #10

Earlier quoted context omitted.

You can always run browser in a vitrual machine. Or open it with a text browser like Lynx or Links. Or use wget to download the file and read in text editor.

But what if the page uses HTML5 audio to "jump the gap" and reprogram all nearby electronic devices to attack you on 1/1/2014!?

Dust of your trusty C64, then you have plenty of time to get yourself some coffee and pull the plug, before the audio starts to play.

Re: OpenSSL.org hacked?

#38

Post by gtklocker »

What is a good reason for openssl.org not to utilize HSTS[1]?

  $ curl -I https://www.openssl.org/
  HTTP/1.1 200 OK
  Date: Sun, 29 Dec 2013 03:57:54 GMT
  Server: Apache/2.2.22 (Ubuntu)
  Accept-Ranges: bytes
  Vary: Accept-Encoding
  Content-Length: 15686
  Content-Type: text/html
[1]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Re: OpenSSL.org hacked?

#39

Post by davvid »

Does anyone have any details about how this was done? Was it a compromised admin account, a local root exploit, social engineering, etc? I'm eagerly awaiting the post-mortem.

Re: OpenSSL.org hacked?

#40

Post by userbinator »

0x0 wrote: post #11
rhgraysonii wrote: post #9

Forgive me for the ignorance but why is this significant if at all? Honestly curious, not being facetious.

If they can replace the front page html, they could probably also replace the source code distribution with a backdoored/trojaned tarball. Or someone else might already have done so, since who knows how long ago, using the same exploit.

But would they also be able to replace the public key of the authors in all the other places it appears on the Internet?
Post reply on HN