501–510 of 547 posts
Earlier quoted context omitted.
Ah, the old middle-management excuse: "We don't have time to write tests!"
When half the secure internet is on fire... yeah, i think that's an acceptable time.
heartbleed.com itself is still using a vulnerable OpenSSL, according to http://filippo.io/Heartbleed/#heartbleed.com
Earlier quoted context omitted.
Isn't there any memory protection on Linux? Something running as www-data shouldn't be able to read the ssh-server's RAM? So it's bad, but it's not that bad unless something exposing this bug (webserver with ssl, vpn, or other service) runs as root?
It might be able to read the memory of the ssl server that's making the response. Including maybe the ssl private key
However -- ssl certs and session keys are a likely target, and combined with passively logging traffic that is enough to compromise all data going over ssl, such as login/passwords and data.
Problem servers include not only web servers, but also imap/pop and smtp servers supporting tls (via openssl -- afaik gnutls isn't vulnerable to this bug).
Found a Python PoC: http://s3.jspenguin.org/ssltest.py Edit: and just used it to dump 64K from a known-vulnerable device we control. Got a session cookie. Jeez.
Earlier quoted context omitted.
Update to 1.0.1g, redo all crypto. That is, revoke certs and keys and regenerate.
What you probably want is to re-key your cert, do not revoke it. Revoking with some CA's (such as GoDaddy) means to essentially cancel the remainder of the valid date forever and requires purchasing a new cert to secure the same domain. You are forfeiting the rest of its value. When you re-key, it will automatically deactivate the previous cert and is free. It also gives you the opportunity to update to SHA-2 or incr…
If you want to be secure, make sure the certificate based on your old key is showing up in the certificate revocation list (CRL), and/or any online certificate status protocol (OCSP) servers it specifies.
Earlier quoted context omitted.
Thanks! So how does this work: Say I have this project and I want it audited -- would you (or the company/person that you had in mind) give me an estimate like "I'd need 3 weeks for 25, 5 weeks for 50 or 10 weeks for 95% coverage" or do you simply analyse away for a week (or whatever time I'm willing to pay you) and try to find something ?
I don't have personal experience with it, but apparently these things are booked months in advance, on a contract basis. The engineer doing the audit spends an agreed number of weeks finding as many problems as they can, and hand you a report at the end.
http://api.rapidshare.com/cgi-bin/rsapi.cgi?sub=getaccountde....
accountid=46048788 firstname=mandeep lastname=sihag servertime=1397038309 addtime=1359871506 username=heavenlybeast directstart=1 country=IN mailflags=n language=en jsconfig= email=heavenlybeast@live.com curfiles=36 curspace=1213591844 rapids=0 billeduntil=0 nortuntil=0 maxspacegb=10 additionalspacegb=0 maxdaytrafficmb=100 additionaldaytrafficmb=0 traffictoday=20511350 accounttype=0 valid=1 payabo=0 promocode=0 promotype=0 promovaliduntil=0 maxfilesize=300000000
btw, is OpenBSD affected or they did the job well by not blindly adding an unnecessary stuff (extensions) and bumping the versions without auditing the changes?