The Heartbleed Challenge • Hacker News Board

Re: The Heartbleed Challenge

#11

Post by jnbiche » Fri, Apr 11, 2014, 1:44 PM UTC

conformal wrote: post #2

what i am expecting ppl to see is that you can't actually get to the tls private key itself. we have done some testing with our backup service, cyphertite, and have yet to attack and actually compromise any keying material. EDIT: forgot to cite neel mehta https://twitter.com/neelmehta/statuses/453625474879471616

You all are involved in so many great open source projects -- just wanted to give a shout-out to Conformal. People do notice and appreciate your contributions.

How many full-time people are working there?

Re: The Heartbleed Challenge

#12

Post by [deleted] » Fri, Apr 11, 2014, 1:44 PM UTC

ig1 wrote: post #7

Is this running on an off-the-shelf nginx or your custom version ?

[deleted]

Re: The Heartbleed Challenge

#13

Post by dfc » Fri, Apr 11, 2014, 1:47 PM UTC

batmansbelt wrote: post #5

Don't be surprised when the winner has an @nsa.gov email address.

I would be shocked if Neel was wrong about private key exposure AND it is a nation state that highlights his misunderstanding.

Re: The Heartbleed Challenge

#14

Post by jgrahamc » Fri, Apr 11, 2014, 1:48 PM UTC

ig1 wrote: post #7

Is this running on an off-the-shelf nginx or your custom version ?

The challenge web site is running stock NGINX.

Re: The Heartbleed Challenge

#15

Post by danielweber » Fri, Apr 11, 2014, 1:48 PM UTC

It's cool seeing other people's attempts to extract the key in my return buffer.

It's like multiplayer microcorruption.com

Re: The Heartbleed Challenge

#16

Post by simias » Fri, Apr 11, 2014, 1:50 PM UTC

It's a good idea but even if nobody successfully exploits this particular website with the heartbleed bug doesn't mean much for the rest of the vulnerable sites.

Since the bug exposes a few kilobytes of uninitialized malloc() memory the kind of data the attacker will retrieve is heavily dependent on the software the server is running.

Re: The Heartbleed Challenge

#17

Post by [deleted] » Fri, Apr 11, 2014, 1:54 PM UTC

eastdakota wrote: post #3

You can read more about the CloudFlare Challenge and our own tests on obtaining SSL Private Key material here: http://blog.cloudflare.com/answering-the-critical-question-c... Matthew Prince Co-founder & CEO, CloudFlare

[deleted]

Re: The Heartbleed Challenge

#18

Post by pornel » Fri, Apr 11, 2014, 1:54 PM UTC

dredge wrote: post #9

For the command to match the description, shouldn't that be "echo -n"? Otherwise the signed string would include a trailing newline. I do not expect this will make a material difference to the challenge - presumably you used the quoted commands to generate the answer.

There is no portable way to echo without a newline. Use printf instead.

Re: The Heartbleed Challenge

#19

Post by Robadob » Fri, Apr 11, 2014, 1:55 PM UTC

Where it might not be possible to get SSL private keys directly via heartbleed. Is there not also the possibility of exposing reused credentials or something that exposes a further exploit that could provide root access or similar to a server, allowing the retrieval of these keys?

It may not be possible in this clean minimal install, but in a real production environment, it should still be treated as a threat?

Re: The Heartbleed Challenge

#20

Post by ygra » Fri, Apr 11, 2014, 1:55 PM UTC

simias wrote: post #16

It's a good idea but even if nobody successfully exploits this particular website with the heartbleed bug doesn't mean much for the rest of the vulnerable sites. Since the bug exposes a few kilobytes of uninitialized malloc() memory the kind of data the attacker will retrieve is heavily dependent on the software the server is running.

I read elsewhere that the bug exposes first and foremost memory that OpenSSL itself used before (because OpenSSL has its own allocator running on top of malloc).