Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL.org hacked?

openssl.org

Post reply on HN
Print view View original

71–80 of 98 posts

Re: OpenSSL.org hacked?

#71

Post by ars_technician »

thirsteh wrote: post #63
peterwwillis wrote: post #53

Earlier quoted context omitted.

SSLStrip does not work on valid HTTPS requests. If you request an HTTPS page, it can not be subverted into HTTP. If it could, HTTPS would be pointless. So, yes, HSTS is not required for a valid HTTPS request. This is not some semantic argument, or some sort of side channel attack crap. HSTS is not necessary for HTTPS requests, period.

It's necessary for HTTP requests. Are you being deliberately obtuse?

It doesn't work if the user hasn't visited the site before because the HSTS header can be stripped just as easily.

Re: OpenSSL.org hacked?

#72

Post by bdamm »

markdown wrote: post #48
peterwwillis wrote: post #46

Earlier quoted context omitted.

What's the use in a static website or a read-only FS when you can overwrite what's in RAM, or just attack routing or DNS? Security is a little more complex.

Ahh yes, the "if you can't turn it into Fort Knox, don't bother at all" guy. Turning up at every security discussion since 1874.

You can't claim that serving static content from a read-only filesystem is "de rigueur", and that securing your DNS registration is "fort knox". I think the point was that the OP was claiming static content from a read-only filesystem as the solution, and the reply was pointing out that this is hardly the best or first actions.

I would personally expect that the openssl group is suffering some embarrassment, but this sort of hack is a risk of the business. Hopefully we get a good writeup.

Re: OpenSSL.org hacked?

#73

Post by gtklocker »

ars_technician wrote: post #71
thirsteh wrote: post #63

Earlier quoted context omitted.

It's necessary for HTTP requests. Are you being deliberately obtuse?

It doesn't work if the user hasn't visited the site before because the HSTS header can be stripped just as easily.

https://news.ycombinator.com/item?id=6978539

Re: OpenSSL.org hacked?

#74

Post by dmix »

dionyziz wrote: post #56
userbinator wrote: post #40

Earlier quoted context omitted.

But would they also be able to replace the public key of the authors in all the other places it appears on the Internet?

That. That's why the authors PGP-sign their sources. Furthermore, some of us maintain GPG trust paths, so replacing it on every other place on the Internet would still be futile.

There is also benefits of using decentralized distribution channels like bittorrent. So a single source can't be compromised.

Re: OpenSSL.org hacked?

#76

Post by verroq »

bdamm wrote: post #72
markdown wrote: post #48

Earlier quoted context omitted.

Ahh yes, the "if you can't turn it into Fort Knox, don't bother at all" guy. Turning up at every security discussion since 1874.

You can't claim that serving static content from a read-only filesystem is "de rigueur", and that securing your DNS registration is "fort knox". I think the point was that the OP was claiming static content from a read-only filesystem as the solution, and the reply was pointing out that this is hardly the best or first actions. I would personally expect that the openssl group is suffering some embarrassment, but this…

The point is that when your attacker has the skill to overwrite your web server's memory to carry out an attack. You never had a chance.

Re: OpenSSL.org hacked?

#77

Post by khc »

hobs wrote: post #28
HCIdivision17 wrote: post #2

For when the page is fixed, it currently says: TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _

Yeah I dont see it at this point, so fairly fast turnaround.

1) hack high profile website 2) wait for it to be posted on hackernews 3) restore the page to appear normal, but embed a browser exploit 4) ... 5) profit!

Re: OpenSSL.org hacked?

#78

Post by peterwwillis »

gtklocker wrote: post #59
peterwwillis wrote: post #47

Earlier quoted context omitted.

Because it doesn't need it. Technically no website needs it. Only people who don't know how to type "https" need it.

Point is, I should not be able to access a plaintext version of a website hosting such cryptographically crucial software/information. It's obvious why it can be a grand target for Man in the Middle, defacement and worst of all integrity attacks. Apart from preventing many of the latter, implementing HSTS could have really mitigated the problem. Anyone who had already visited the site wouldn't see the defaced page. F…

Or maybe they should have plaintext access, because then they can get the software if they don't have an SSL-enabled HTTP client, and they can compare the digital signature of the sources later via 3rd parties.

But this is all crap, really. OpenSSL is a library distributed across tens of thousands of independent providers all over the internet. Nobody needs to get it from the main site, and even if they do, there's a multitude of ways to tell if it's the real deal or not. If you know what OpenSSL is, you can type in "https" and be totally secure without HSTS. Even if you needed HSTS (which you don't), who's going to the OpenSSL.org website time after time that HSTS would even be useful?

People make way too big a deal over half-baked countermeasures that don't apply to every case. You find me the person who's downloading vanilla OpenSSL libraries from the main site over multiple visits and is at risk of a client-side MITM and not verifying their sources, and i'll show you someone who's going to get owned even without a MITM.

Re: OpenSSL.org hacked?

#79

Post by alexmuller »

grogenaut wrote: post #61
hobs wrote: post #28

Earlier quoted context omitted.

Yeah I dont see it at this point, so fairly fast turnaround.

I've wondered this for quite a while but why isn't there a standard for browsers like Download with check I mean no one ever checks them anyways so it's not like they're useful. The second step would to be to provide a reputable repo of software version -> checksum lookups so I didn't have to trust a given server for that. This is me thinking and drinking and I'd love comments.

Content-Security-Policy is doing something vaguely similar with tags, where you add a nonce in the HTTP header and then only tags with those nonces are executed.

script-src at http://www.w3.org/TR/CSP11/

Re: OpenSSL.org hacked?

#80

Post by dionyziz »

peterwwillis wrote: post #78
gtklocker wrote: post #59

Earlier quoted context omitted.

Point is, I should not be able to access a plaintext version of a website hosting such cryptographically crucial software/information. It's obvious why it can be a grand target for Man in the Middle, defacement and worst of all integrity attacks. Apart from preventing many of the latter, implementing HSTS could have really mitigated the problem. Anyone who had already visited the site wouldn't see the defaced page. F…

Or maybe they should have plaintext access, because then they can get the software if they don't have an SSL-enabled HTTP client, and they can compare the digital signature of the sources later via 3rd parties. But this is all crap, really. OpenSSL is a library distributed across tens of thousands of independent providers all over the internet. Nobody needs to get it from the main site, and even if they do, there's a…

You seem to have completely missed the fact that HSTS can be combined with an STS preloaded list, to which the previous comment author also gave you a reference to read. HSTS is TOFU (trust-on-first-use) by default, but the TOFU portion can be upgraded to a full PKI-based authentication mechanism just fine using preloaded lists, which doesn't require any previous visits whatsoever.

Furthermore, it's just embarrassing to see such attacks on these high-profile sites. If they can't defend their site (even for users who don't type "https://"), who is to say their library is secure? These kinds of attacks threaten the confidence we have on our fundamental cryptographic building blocks and should be avoided.

Post reply on HN