ssl_certificate /home/nick/ssl-bundle.crt ssl_certificate_key /home/nick/server.key
Got that one too. Also got this [1] but it looks like public keys maybe ? I'dont have time to check right now.
The Heartbleed Challenge
21–30 of 125 posts
Re: The Heartbleed Challenge
#22You can read more about the CloudFlare Challenge and our own tests on obtaining SSL Private Key material here: http://blog.cloudflare.com/answering-the-critical-question-c... Matthew Prince Co-founder & CEO, CloudFlare
[deleted]
The don't sign comments rule is designed to stop pointless posting of company URLs when there is no need to. In this case it is clearly appropriate for Matthew to disclose who he is as it is important to the context of the post.
Re: The Heartbleed Challenge
#23I must be the only one that's pretty much done with having to read about heartbleed.
Re: The Heartbleed Challenge
#24For the command to match the description, shouldn't that be "echo -n"? Otherwise the signed string would include a trailing newline. I do not expect this will make a material difference to the challenge - presumably you used the quoted commands to generate the answer.
There is no portable way to echo without a newline. Use printf instead.
Meanwhile over in a Makefile...
# Automatically figure out what echo options to use so that echo
# '\r\n' actually just outputs the characters CR and LF and nothing
# else. This is very shell dependent.
ECHO_OPTIONS := -e -n -en
ECHO :=
$(foreach o,$(ECHO_OPTIONS),$(if $(call seq,$(shell echo $o '\r\n' | wc -
c),2),$(eval ECHO := echo $o)))
ifeq ($(ECHO),)
$(error Failed to set ECHO, unable to determine correct echo command,
tried options $(ECHO_OPTIONS))
endifRe: The Heartbleed Challenge
#25what i am expecting ppl to see is that you can't actually get to the tls private key itself. we have done some testing with our backup service, cyphertite, and have yet to attack and actually compromise any keying material. EDIT: forgot to cite neel mehta https://twitter.com/neelmehta/statuses/453625474879471616
You all are involved in so many great open source projects -- just wanted to give a shout-out to Conformal. People do notice and appreciate your contributions. How many full-time people are working there?
we appreciate your supportive comments :)
there are about 10 of us at conformal.
Re: The Heartbleed Challenge
#26Is this really an accurate challenge? I have wondered if the true exposure risk from Heartbleed may be over-stated* due to memory separation between processes, etc. This however is probably a clean server with a fairly static install. There isn't a risk of things like session leakage which I think is the true risk of Heartbleed. Nor would there be the memory fragmentation that would occur in a production system. While intriguing I'm not sure how much it proves?
(* this is still good though as any risk is unacceptable and shouting Fire makes everyone move... and they need to on this issue)
Re: The Heartbleed Challenge
#27Is this really an accurate challenge? I have wondered if the true exposure risk from Heartbleed may be over-stated* due to memory separation between processes, etc. This however is probably a clean server with a fairly static install. There isn't a risk of things like session leakage which I think is the true risk of Heartbleed. Nor would there be the memory fragmentation that would occur in a production system. Whil…
There's no memory separation between a web server that incorporates OpenSSL and... itself.
Re: The Heartbleed Challenge
#28A different CloudFlare post on HN https://news.ycombinator.com/item?id=7572666 claimed that they had a fix for the HeartBleed bug 12 days ago.
At CloudFlare, we received early warning of the Heartbleed vulnerability and patched our systems 12 days ago.
I commented on that post that the date of discovery was 7 days ago http://www.vocativ.com/tech/hacking/behind-scenes-crazy-72-h...
For whatever reason that HN post was deleted and resubmitted so it now has no comments on it. https://news.ycombinator.com/item?id=7572796
Was the bug discovered 12 days ago or 7?
Re: The Heartbleed Challenge
#29Is this really an accurate challenge? I have wondered if the true exposure risk from Heartbleed may be over-stated* due to memory separation between processes, etc. This however is probably a clean server with a fairly static install. There isn't a risk of things like session leakage which I think is the true risk of Heartbleed. Nor would there be the memory fragmentation that would occur in a production system. Whil…
There's no memory separation between a web server that incorporates OpenSSL and... itself.
It might be more accurate if this server ran some services, though, like a real server would.
Re: The Heartbleed Challenge
#30A different CloudFlare post on HN https://news.ycombinator.com/item?id=7572666 claimed that they had a fix for the HeartBleed bug 12 days ago. At CloudFlare, we received early warning of the Heartbleed vulnerability and patched our systems 12 days ago. I commented on that post that the date of discovery was 7 days ago http://www.vocativ.com/tech/hacking/behind-scenes-crazy-72-h... For whatever reason that HN post was…
The bug was discovered by whitehat researchers approximately 12 days ago. It was publicly announced 5 days ago. We got early word of it from the researchers who initially discovered it, allowing us to patch our systems and ensure all sites behind CloudFlare were not vulnerable. However, we have no way of knowing how long blackhats may have had it. It had been present in the OpenSSL software for the last 2+ years. Therefore we're trying to get an informed sense of the security risks. Hence our work attempting to use the vulnerability to recover SSL private keys and, as announced today, the CloudFlare Challenge.