The Heartbleed Challenge • Hacker News Board

Re: The Heartbleed Challenge

#101

Post by euank » Fri, Apr 11, 2014, 6:32 PM UTC

michaelt wrote: post #79

dubcanada wrote: post #71

Earlier quoted context omitted.

It doesn't matter if they show "responsibly disclosed" all their repos are publicly available to see, it takes one person looking through commits then going wtf is this followed by a quick look at the code and a blog post to make this a wildfire.

I think the notion is the distro security team codes and tests a patch, but doesn't commit the code to public repos or release the patch publicly until an agreed-upon disclosure date.

Not necessarily that the distro security team codes the patch even. In most cases, upstream (e.g. openssl here) should have an official patch/commit that is private, but is given to these trusted distros. The security team only has to create a package with the upstream patch.

Other than that, yes, that's exactly the notion.

Re: The Heartbleed Challenge

#102

Post by wglb » Fri, Apr 11, 2014, 6:43 PM UTC

conformal wrote: post #2

what i am expecting ppl to see is that you can't actually get to the tls private key itself. we have done some testing with our backup service, cyphertite, and have yet to attack and actually compromise any keying material. EDIT: forgot to cite neel mehta https://twitter.com/neelmehta/statuses/453625474879471616

This post first agreed, then upon further review retracted that finding: https://news.ycombinator.com/item?id=7561399

Re: The Heartbleed Challenge

#103

Post by koliber » Fri, Apr 11, 2014, 7:39 PM UTC

So out of curiosity, I ran the python heartbleed tester against their server. Surprisingly, the first (and every response thereafter) returned a memory dump which contained at least part of what looked like a private key. I immediately became skeptical when each of these apparent private keys ended in LOLJK.

  0690: 79 37 70 71 31 76 63 2F 74 70 49 67 68 4C 4F 4C  y7pq1vc/tpIghLOL
  06a0: 4A 4B 3D 3D 2D 2D 2D 2D 2D 45 4E 44 5F 52 53 41  JK==-----END_RSA
  06b0: 5F 50 52 49 56 41 54 45 5F 4B 45 59 2D 2D 2D 2D  _PRIVATE_KEY----

Seems like a clever setup to return hand-crafted responses.

Re: The Heartbleed Challenge

#104

Post by alexkus » Fri, Apr 11, 2014, 7:41 PM UTC

kaivi wrote: post #75

danielweber wrote: post #15

It's cool seeing other people's attempts to extract the key in my return buffer. It's like multiplayer microcorruption.com

This is fun, indeed. Has anyone already made a patch for this bug, where the lib returns random data instead of actual heap chunks?

Irony would be such a patch leaking information about the state of any random number generator leading to more easily guessable session keys or the like.

(Of course, creating suitable fake data with a separate PNRG to avoid this would be pretty easy.)

Re: The Heartbleed Challenge

#105

Post by thedufer » Fri, Apr 11, 2014, 8:09 PM UTC

51Cards wrote: post #26

Is this really an accurate challenge? I have wondered if the true exposure risk from Heartbleed may be over-stated* due to memory separation between processes, etc. This however is probably a clean server with a fairly static install. There isn't a risk of things like session leakage which I think is the true risk of Heartbleed. Nor would there be the memory fragmentation that would occur in a production system. Whil…

Anything OpenSSL decrypts surely has to hit the OpenSSL process's memory, right? That would include requests, which could easily contain sessions, passwords, etc.

Re: The Heartbleed Challenge

#106

Post by zenojevski » Fri, Apr 11, 2014, 9:10 PM UTC

koliber wrote: post #103

So out of curiosity, I ran the python heartbleed tester against their server. Surprisingly, the first (and every response thereafter) returned a memory dump which contained at least part of what looked like a private key. I immediately became skeptical when each of these apparent private keys ended in LOLJK. 0690: 79 37 70 71 31 76 63 2F 74 70 49 67 68 4C 4F 4C y7pq1vc/tpIghLOL 06a0: 4A 4B 3D 3D 2D 2D 2D 2D 2D 45 4E…

Got that too:

  1ef0: 4E 63 46 39 33 51 75 34 64 2F 48 6E 47 6D 4B 50  NcF93Qu4d/HnGmKP
  1f00: 51 42 72 4A 43 50 53 69 54 67 70 2F 63 79 37 70  QBrJCPSiTgp/cy7p
  1f10: 71 31 76 63 2F 74 70 49 67 68 4C 4F 4C 4A 4B 3D  q1vc/tpIghLOLJK=
  1f20: 3D 2D 2D 2D 2D 2D 45 4E 44 25 32 30 52 53 41 25  =-----END%20RSA%
  1f30: 32 30 50 52 49 56 41 54 45 25 32 30 4B 45 59 2D  20PRIVATE%20KEY-
  1f40: 2D 2D 2D 2D 20 48 54 54 50 2F 31 2E 31 0D 0A 48  ---- HTTP/1.1..H

Curiously enough, one of the first responses, after which they became somewhat predictable (with the occasional "herring").

Seems like some experimenting (based on differing offset, and `%20` vs `_`).

Re: The Heartbleed Challenge

#107

Post by just2n » Fri, Apr 11, 2014, 9:17 PM UTC

tptacek wrote: post #50

leigh_t wrote: post #49

Earlier quoted context omitted.

Please please please email out to past participants when it is available, the first one was amazing amounts of fun.

The new one is b-a-n-a-n-a-s.

What do you mean "multiplayer"?

In the spirit of this challenge? A single exploitable endpoint where any number of N people are to go at the same implementation?

You can't tease this hard, man.

Also, Friday launch? :)

Re: The Heartbleed Challenge

#108

Post by quasque » Fri, Apr 11, 2014, 9:43 PM UTC

danielweber wrote: post #98

eastdakota wrote: post #3

You can read more about the CloudFlare Challenge and our own tests on obtaining SSL Private Key material here: http://blog.cloudflare.com/answering-the-critical-question-c... Matthew Prince Co-founder & CEO, CloudFlare

What is the format of the private key? I.e., is it a 8192-bit AES256 key?

It's using RSA with key length of 2048 bits [1], and one can assume that both prime factors have equal bit length [2] i.e. 1024 bits each, and so the size of all the other private components can be derived from that. I don't know what OpenSSL's in-memory format is for this data, I suppose therein lies a good part of the challenge!

[1] https://www.ssllabs.com/ssltest/analyze.html?d=cloudflarecha...

[2] https://github.com/openssl/openssl/blob/master/crypto/rsa/rs...

Re: The Heartbleed Challenge

#109

Post by umrashrf » Fri, Apr 11, 2014, 9:48 PM UTC

Look what I found...

  0390: 00 00 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  ..OLOLOLOLOLOLOL
  03a0: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL
  03b0: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL
  03c0: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL
  03d0: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL
  03e0: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL
  03f0: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL
  0400: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL
  0410: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL
  0420: 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C 4F 4C  OLOLOLOLOLOLOLOL

Re: The Heartbleed Challenge

#110

Post by chacham15 » Fri, Apr 11, 2014, 10:10 PM UTC

tptacek wrote: post #50

leigh_t wrote: post #49

Earlier quoted context omitted.

Please please please email out to past participants when it is available, the first one was amazing amounts of fun.

The new one is b-a-n-a-n-a-s.

Care to post more info about it?