This is scary: # ./hb-test.py mail.yahoo.com |grep -A3 -B3 pass
[deleted]
Hijacking user sessions with the Heartbleed vulnerability
11–20 of 70 posts
Re: Hijacking user sessions with the Heartbleed vulnerability
#12Wow, just piping the output from this proof of concept python script through grep and searching for the string "pass" shows that on a number of sites that are vulnerable it is that easy to pull a logged in user's username and password. Scary...
Yeah, up until very recently it would be possible to make a script that would log you into a random yahoo mail account. For vulnerable servers right now it would be better to just block port 443, forcing regular HTTP is safer.
Re: Hijacking user sessions with the Heartbleed vulnerability
#13This is scary: # ./hb-test.py mail.yahoo.com |grep -A3 -B3 pass
What's potentially scarier than plaintext passwords leaking out is that key material leaks as well.
64k of random memory is bad, 64k of OpenSSL's state is worse.
Also, why haven't Yahoo taken down their login service yet? I really don't see how leaving your users' passwords leaking in plaintext is ever better than downtime. Someone had to have made that call, and I really don't think it was the right one. Will be interesting to see how the media treats this over the next few days.
EDIT: Looks like Yahoo is finally fixed. Wonder how many accounts were compromised in the interim, and if their cert and private key were compromised as well. Does not look like they've re-issued yet.
Re: Hijacking user sessions with the Heartbleed vulnerability
#14This is scary: # ./hb-test.py mail.yahoo.com |grep -A3 -B3 pass
seems to be patched now
Re: Hijacking user sessions with the Heartbleed vulnerability
#15This is scary: # ./hb-test.py mail.yahoo.com |grep -A3 -B3 pass
Scary indeed. Has anyone created a status-board kind of site to show which major servers were affected and which are still affected?
I'd like to start changing passwords, but it doesn't do much good until things are fixed.
Re: Hijacking user sessions with the Heartbleed vulnerability
#16This is scary: # ./hb-test.py mail.yahoo.com |grep -A3 -B3 pass
Give grep's -C option a try!
Re: Hijacking user sessions with the Heartbleed vulnerability
#17Dollars to donuts the NSA has had this hack in its bag of tricks.
Re: Hijacking user sessions with the Heartbleed vulnerability
#18Dollars to donuts the NSA has had this hack in its bag of tricks.
Maybe it will be easier to look through the Snowden documents for this, now that we know about it, and see if they had it.
Re: Hijacking user sessions with the Heartbleed vulnerability
#19This is one of these things of which you think "Ah, what are the odds of me being affected?" but quickly changing to "This is pretty bad..." and finally to "FUCK FUCK FUCK, WHY?". Two years is a long time, people. If ordinary people can write proof of concepts in less than 24 hours after it is publicly disclosed, what to think of those getting paid to find and abuse such bugs? I mean, what are the odds this bug was n…
It might be a coincidence, but last month I received an alert that someone tried to sign in to my hosting control panel using a correct password (which was long and random), but was blocked by a geo-filter (which blocks requests outside of my country) fortunately. I do not know up to this day how my password did leak, and that's one possible candidate cause.
I had similar issue with my email account. The password is only used for that specific service and I got a notification yesterday that someone had tried to access the account with correct password.
Coincidence, could be. But probably not.
Re: Hijacking user sessions with the Heartbleed vulnerability
#20It's not a vulnerability. It's a BACKDOOR.