The Heartbleed Bug • Hacker News Board

Re: The Heartbleed Bug

#31

Post by huherto » Mon, Apr 07, 2014, 9:16 PM UTC

Is it a problem for those using ssh keys on github ?

Re: The Heartbleed Bug

#32

Post by NelsonMinar » Mon, Apr 07, 2014, 9:16 PM UTC

iso8859-1 wrote: post #9

Here's the patch/commit, I don't know why it's not linked form the OpenSSL changelog or heartbleed.com. A suspicious lack of transparency. http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=...

I'm very curious to see the change that introduced the bug in the first place. According to the announcement it was introduced in 1.0.1. That's the version that added Heartbeat support, so maybe it was a bug from the beginning.

Re: The Heartbleed Bug

#33

Post by chomp » Mon, Apr 07, 2014, 9:18 PM UTC

How did Cloudflare get access to this bug a week before it was made public, yet no distro has a package ready?

How's that for responsible disclosure?

Re: The Heartbleed Bug

#34

Post by sexmonad » Mon, Apr 07, 2014, 9:18 PM UTC

ams6110 wrote: post #30

cheald wrote: post #2

What a great writeup. Comprehensive without being overly verbose, answers to "what does this mean?" and "does this affect me?", and clear calls to action. While I'm not happy at having to spend my Monday patching a kajillion machines, I welcome more vulnerability writeups in this vein.

Writeup was too long. We need to know the short and sweet of what to fix.

Update to 1.0.1g, redo all crypto. That is, revoke certs and keys and regenerate.

Re: The Heartbleed Bug

#35

Post by amalcon » Mon, Apr 07, 2014, 9:18 PM UTC

whyleyc wrote: post #27

tptacek wrote: post #24

Earlier quoted context omitted.

The bug is in the handling of the TLS protocol itself (actually, in a little-used extension of TLS, the TLS Record Layer Heartbeat Protocol), and isn't exposed in applications that just use TLS for crypto primitives.

Sooo in layman's terms - we only need to be worrying about HTTPS and not SSH ?

Not only HTTPS. Many other protocols are TLS-based: modern email, some VPNs, etc. Really almost everything secret on the Internet is protected by TLS; SSH is a rare exception.

Re: The Heartbleed Bug

#36

Post by stu_k » Mon, Apr 07, 2014, 9:19 PM UTC

MartinMond wrote: post #20

As of now (21:04 UTC) this isn't fixed in Debian https://security-tracker.debian.org/tracker/CVE-2014-0160 nor Ubuntu http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20... Got a long night ahead :/

Thanks for the links. The big thing heartbleed.com is missing is what to do!

Re: The Heartbleed Bug

#37

Post by mark-r » Mon, Apr 07, 2014, 9:21 PM UTC

Any chance this bug originated with the NSA? It seems like it would fall under their goal of subverting the infrastructure that keeps secrets on the internet. Of course this is exactly why such a goal is a bad idea - an unprotected internet causes widespread damage.

Re: The Heartbleed Bug

#38

Post by tptacek » Mon, Apr 07, 2014, 9:22 PM UTC

gojomo wrote: post #26

tptacek wrote: post #24

Earlier quoted context omitted.

The bug is in the handling of the TLS protocol itself (actually, in a little-used extension of TLS, the TLS Record Layer Heartbeat Protocol), and isn't exposed in applications that just use TLS for crypto primitives.

Does sshd only use TLS/OpenSSL "for crypto primitives"? Or not use OpenSSL at all?

sshd implements the SSH protocol, not the TLS protocol.

Re: The Heartbleed Bug

#39

Post by oskarth » Mon, Apr 07, 2014, 9:23 PM UTC

This thing has been in the wild for two years. What are the odds it hasn't been systematically abused? And what does this imply?

To me it sounds kind of like finding out the fence in your backyard was cut open two years ago. Except in this case the backyard is two thirds of the internet.

Re: The Heartbleed Bug

#40

Post by whyleyc » Mon, Apr 07, 2014, 9:23 PM UTC

rguldener wrote: post #23

astrange wrote: post #18

Are people going straight to buying new domain names for every TLS bug discovered these days?

I'd be surprised if heartbleed.com was still available in 2014

It was - registered 2 days ago by Marko Laakso from Codenomicon, the guys credited (by themselves it seems !) with finding the bug:

http://www.networksolutions.com/whois/results.jsp?domain=hea...