Is the vulnerability, or this script to exploit it, platform-specific? I tried this script against a Raspberry Pi running Raspbian with an unpatched OpenSSL library, but received an unexpected EOF.
Hijacking user sessions with the Heartbleed vulnerability
21–30 of 70 posts
Re: Hijacking user sessions with the Heartbleed vulnerability
#22It's not a vulnerability. It's a BACKDOOR.
I don't believe there's any evidence on that yet, so please cool your jets. One dev wrote that line of code but anyone could have made that mistake.
Re: Hijacking user sessions with the Heartbleed vulnerability
#23Re: Hijacking user sessions with the Heartbleed vulnerability
#24For SSH it's common to use private keys to communicate securely with servers using public key cryptography. This is convenient and protects against key loggers. What are the possibilities of using public key cryptography in the browser? For example, I upload my public key to some website, create an account which is locked to my private key. I get the convenience of not having to log in manually and some extra safety.
I believe what you're describing is encompassed by SSL client certificates. They're supported, but roughly nobody uses them for some reason.
What a shame, maybe now something will change. I won't miss typing in passwords at all.
Re: Hijacking user sessions with the Heartbleed vulnerability
#25What tool is he using for editing his cookies?
Re: Hijacking user sessions with the Heartbleed vulnerability
#26Dollars to donuts the NSA has had this hack in its bag of tricks.
But using it would reveal it if anyone was capturing traffic of SSL requests. "Why in the world did they do a heartbeat test . . . hey, what's all that stuff . . . OHMIGOD."
Re: Hijacking user sessions with the Heartbleed vulnerability
#27What tool is he using for editing his cookies?
EditThisCookie extension: https://chrome.google.com/webstore/detail/editthiscookie/fng...
Re: Hijacking user sessions with the Heartbleed vulnerability
#28Is the vulnerability, or this script to exploit it, platform-specific? I tried this script against a Raspberry Pi running Raspbian with an unpatched OpenSSL library, but received an unexpected EOF.
If your webserver has the vulnerable version of the OpenSSL library, then your server will return some extra bytes, from someplace in memory.
It may turn out that the space in memory it's returning from is useless. Or, like yahoo, you may be giving out plain-text ASCII passwords to complete strangers who can type a command line. Which of these two extremes you get is largely based on luck.
Re: Hijacking user sessions with the Heartbleed vulnerability
#29Wow, just piping the output from this proof of concept python script through grep and searching for the string "pass" shows that on a number of sites that are vulnerable it is that easy to pull a logged in user's username and password. Scary...
Although there are no guarantees there, what you are likely getting is people logging in very recently because their POST request is still in memory. If you were just logged in with an old session from a few hours ago, it's unlikely your PUSH request will still be in memory.
But every time you connect you are sending a cookie which allows for session hijacking.
Re: Hijacking user sessions with the Heartbleed vulnerability
#30Dollars to donuts the NSA has had this hack in its bag of tricks.
But using it would reveal it if anyone was capturing traffic of SSL requests. "Why in the world did they do a heartbeat test . . . hey, what's all that stuff . . . OHMIGOD ."
It's unlikely that anyone would be logging that these network requests would be made, let alone the raw input/output. This level of network logging is typically only turned on briefly for diagnostics.