Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL.org hacked?

openssl.org

Post reply on HN
Print view View original

51–60 of 98 posts

Re: OpenSSL.org hacked?

#51

Post by dionyziz »

peterwwillis wrote: post #47
gtklocker wrote: post #38

What is a good reason for openssl.org not to utilize HSTS[1]? $ curl -I https://www.openssl.org/ HTTP/1.1 200 OK Date: Sun, 29 Dec 2013 03:57:54 GMT Server: Apache/2.2.22 (Ubuntu) Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 15686 Content-Type: text/html [1]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Because it doesn't need it. Technically no website needs it. Only people who don't know how to type "https" need it.

Which is, to say, 99.99% of people. Noone types "https://" or "http://"; 99% of people don't even know what https means. Us developers should know better and protect our users. It's our responsibility to make sure the default is secure.

Re: OpenSSL.org hacked?

#53

Post by peterwwillis »

netik wrote: post #49
peterwwillis wrote: post #47

Earlier quoted context omitted.

Because it doesn't need it. Technically no website needs it. Only people who don't know how to type "https" need it.

No. HSTS prevents SSLStrip attacks when the intended destination is always meant to be in SSL.

SSLStrip does not work on valid HTTPS requests. If you request an HTTPS page, it can not be subverted into HTTP. If it could, HTTPS would be pointless. So, yes, HSTS is not required for a valid HTTPS request. This is not some semantic argument, or some sort of side channel attack crap. HSTS is not necessary for HTTPS requests, period.

Re: OpenSSL.org hacked?

#54

Post by doomrobo »

jrockway wrote: post #18
babuskov wrote: post #10

Earlier quoted context omitted.

You can always run browser in a vitrual machine. Or open it with a text browser like Lynx or Links. Or use wget to download the file and read in text editor.

But what if the page uses HTML5 audio to "jump the gap" and reprogram all nearby electronic devices to attack you on 1/1/2014!?

That's professional paranoia right there. Someone give this man a job and a hard hat.

Re: OpenSSL.org hacked?

#55

Post by mrjaeger »

bengarvey wrote: post #41
dangrossman wrote: post #19

Earlier quoted context omitted.

$ curl -A "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36" www.openssl.org

But what if they return a joke, so funny, that it kills whoever reads it?

Then they should split on spaces and only read one word at a time

Re: OpenSSL.org hacked?

#56

Post by dionyziz »

userbinator wrote: post #40
0x0 wrote: post #11

Earlier quoted context omitted.

If they can replace the front page html, they could probably also replace the source code distribution with a backdoored/trojaned tarball. Or someone else might already have done so, since who knows how long ago, using the same exploit.

But would they also be able to replace the public key of the authors in all the other places it appears on the Internet?

That. That's why the authors PGP-sign their sources. Furthermore, some of us maintain GPG trust paths, so replacing it on every other place on the Internet would still be futile.

Re: OpenSSL.org hacked?

#57

Post by dionyziz »

bengarvey wrote: post #41
dangrossman wrote: post #19

Earlier quoted context omitted.

$ curl -A "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36" www.openssl.org

But what if they return a joke, so funny, that it kills whoever reads it?

https://en.wikipedia.org/wiki/Death_from_laughter

Re: OpenSSL.org hacked?

#58

Post by peterwwillis »

orclev wrote: post #50
peterwwillis wrote: post #46

Earlier quoted context omitted.

What's the use in a static website or a read-only FS when you can overwrite what's in RAM, or just attack routing or DNS? Security is a little more complex.

The point is to minimize attack surfaces. If you're serving static content that's one less path for an attacker to potentially exploit. With only static files exploits are limited to those contained in the web server or the OS network code. With a read only filesystem certain classes of privilege escalation are eliminated. Attacks on routing or DNS are more difficult to deal with, but at least it isn't your server be…

Are you kidding me?! At the very least suggest Grsec, SELinux, containers! Who gives a shit about "certain classes" of privilege escalation? Are you securing your webserver against 5th graders or actual hackers?

If you want to minimize your attack surface, what he suggested is quite possibly the least effective possible thing anyone could do. I point out just a few of the more important issues to consider first, and you tell ME I don't know about security? I don't know what kind of systems you secure, but mine don't rely on 'mount -o ro,remount /' as a defense strategy.

Re: OpenSSL.org hacked?

#59

Post by gtklocker »

peterwwillis wrote: post #47
gtklocker wrote: post #38

What is a good reason for openssl.org not to utilize HSTS[1]? $ curl -I https://www.openssl.org/ HTTP/1.1 200 OK Date: Sun, 29 Dec 2013 03:57:54 GMT Server: Apache/2.2.22 (Ubuntu) Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 15686 Content-Type: text/html [1]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Because it doesn't need it. Technically no website needs it. Only people who don't know how to type "https" need it.

Point is, I should not be able to access a plaintext version of a website hosting such cryptographically crucial software/information.

It's obvious why it can be a grand target for Man in the Middle, defacement and worst of all integrity attacks. Apart from preventing many of the latter, implementing HSTS could have really mitigated the problem. Anyone who had already visited the site wouldn't see the defaced page. Furthermore, they could get added to an STS preloaded list[1], making the attack invisible to anyone using a modern browser.

If you are interested, the Wikipedia page[2] does a fair job at explaining more about why HSTS is needed.

[1]: https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...

[2]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security...

Re: OpenSSL.org hacked?

#60

Post by peterwwillis »

dionyziz wrote: post #51
peterwwillis wrote: post #47

Earlier quoted context omitted.

Because it doesn't need it. Technically no website needs it. Only people who don't know how to type "https" need it.

Which is, to say, 99.99% of people. Noone types " https://" or " http://"; 99% of people don't even know what https means. Us developers should know better and protect our users. It's our responsibility to make sure the default is secure.

But you expect 99% of all people are downloading vanilla OpenSSL libraries. Because that's a thing that everyone does.
Post reply on HN