The Heartbleed Challenge

#1

Post by jgrahamc » Fri, Apr 11, 2014, 12:46 PM UTC

The Heartbleed Challenge
cloudflarechallenge.com

Re: The Heartbleed Challenge

#2

Post by conformal » Fri, Apr 11, 2014, 1:21 PM UTC

what i am expecting ppl to see is that you can't actually get to the tls private key itself. we have done some testing with our backup service, cyphertite, and have yet to attack and actually compromise any keying material.

EDIT: forgot to cite neel mehta https://twitter.com/neelmehta/statuses/453625474879471616

Re: The Heartbleed Challenge

#3

Post by eastdakota » Fri, Apr 11, 2014, 1:22 PM UTC

You can read more about the CloudFlare Challenge and our own tests on obtaining SSL Private Key material here:

http://blog.cloudflare.com/answering-the-critical-question-c...

Matthew Prince Co-founder & CEO, CloudFlare

Re: The Heartbleed Challenge

#4

Post by NKCSS » Fri, Apr 11, 2014, 1:24 PM UTC

Too bad the link they give on that page doesn't exist (yet): http://blog.cloudflare.com/the-heartbleed-challenge/

Re: The Heartbleed Challenge

#5

Post by batmansbelt » Fri, Apr 11, 2014, 1:26 PM UTC

Don't be surprised when the winner has an @nsa.gov email address.

Re: The Heartbleed Challenge

#6

Post by jgrahamc » Fri, Apr 11, 2014, 1:26 PM UTC

NKCSS wrote: post #4

Too bad the link they give on that page doesn't exist (yet): http://blog.cloudflare.com/the-heartbleed-challenge/

Sorry about that. It's meant to redirect to: http://blog.cloudflare.com/answering-the-critical-question-c...

Re: The Heartbleed Challenge

#7

Post by ig1 » Fri, Apr 11, 2014, 1:28 PM UTC

Is this running on an off-the-shelf nginx or your custom version ?

Re: The Heartbleed Challenge

#8

Post by conformal » Fri, Apr 11, 2014, 1:29 PM UTC

eastdakota wrote: post #3

You can read more about the CloudFlare Challenge and our own tests on obtaining SSL Private Key material here: http://blog.cloudflare.com/answering-the-critical-question-c... Matthew Prince Co-founder & CEO, CloudFlare

nice write up. we saw similar results in that the keying material never made it into the memory leaked.

i've never felt so thankful for a memory allocation pattern.

Re: The Heartbleed Challenge

#9

Post by dredge » Fri, Apr 11, 2014, 1:39 PM UTC

For the command to match the description, shouldn't that be "echo -n"? Otherwise the signed string would include a trailing newline.

I do not expect this will make a material difference to the challenge - presumably you used the quoted commands to generate the answer.

Re: The Heartbleed Challenge

#10

Post by livid » Fri, Apr 11, 2014, 1:39 PM UTC

ssl_certificate /home/nick/ssl-bundle.crt

ssl_certificate_key /home/nick/server.key