Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudFlare's Heartbleed challenge cracked

twitter.com

Post reply on HN
Print view View original

41–50 of 155 posts

Re: CloudFlare's Heartbleed challenge cracked

#41

Post by danielweber »

tomkwok wrote: post #37

* From https://www.cloudflarechallenge.com/heartbleed * So far, two people have independently solved the Heartbleed Challenge. The first was submitted at 4:22:01PST by Fedor Indutny (@indutny). He sent at least 2.5 million requests over the span of the challenge, this was approximately 30% of all the requests we saw. The second was submitted at 5:12:19PST by Illkka Mattila using around 100 thousand requests. We confi…

I wonder if the trick is to just send so many things that memory wraps around to a place where the key is exposed.

Re: CloudFlare's Heartbleed challenge cracked

#42

Post by jneal »

tomkwok wrote: post #37

* From https://www.cloudflarechallenge.com/heartbleed * So far, two people have independently solved the Heartbleed Challenge. The first was submitted at 4:22:01PST by Fedor Indutny (@indutny). He sent at least 2.5 million requests over the span of the challenge, this was approximately 30% of all the requests we saw. The second was submitted at 5:12:19PST by Illkka Mattila using around 100 thousand requests. We confi…

I probably hit the server only a thousand times thinking that could be enough, I was far off.

Re: CloudFlare's Heartbleed challenge cracked

#44

Post by capcah »

I am not sure how those guys did it, but I was talking to a friend of mine today, and I guess that it had something to do with forcing the server to use its private key to check for information sent to it. Then you use the heartbleed bug to intercept the intermediate forms on the information you sent to be decrypted/authenticated. Since you know the plaintext, the ciphertext and the intermediate forms, it should be possible to recover the key.

As I said, I am not sure that is right or if that was the method used to exploit cloudflare, as I didn't had the time nor the knowledge of openssl implementation to test it out, I am just throwing my guess out there before the official exploit comes about.

edit: formatting

Re: CloudFlare's Heartbleed challenge cracked

#45

Post by quasque »

alex_marchant wrote: post #20
gojomo wrote: post #19

Earlier quoted context omitted.

Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name. Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning. Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.

But seems like only the http connection is working, i get a warning in Chrome when visiting https://cloudflarechallenge.com . Isn't that the only situation where the key would be checked. That's the part that doesn't make sense.

Also possible to verify using OpenSSL commandline:

    openssl s_client -connect 165.225.128.15:443 -showcerts \ 
                  -servername www.cloudflarechallenge.com
(Though to fully check, you need to compare certificates with the one off the real site, and ensure that his blog appears upon an HTTP request - to exclude proxying.)

Re: CloudFlare's Heartbleed challenge cracked

#46

Post by Asparagirl »

just2n wrote: post #16
spindritf wrote: post #8

Earlier quoted context omitted.

No. This means you need to change keys for every ssl service you run. Passwords were known to be leaked earlier.

Really it means (as everyone assumed in the first place) that anything a web server might have in its heap needs to be totally thrown away. Private keys. Passwords. Credit card numbers. Security questions/answers. Sessions. Anything you'd send to a web server or receive from a web server is presumed compromised.

Seen on Twitter a few days ago: "Heartbleed is the Red Wedding of the Internet". Thought it hyperbolic at the time, but not any more...

Re: CloudFlare's Heartbleed challenge cracked

#47

Post by dfc »

fletchowns wrote: post #39
ademarre wrote: post #34

https://twitter.com/eastdakota/status/454792635279220737 Pic of the CloudFlare team reviewing the attack. Ten guys crowded around one monitor.

Hah! That's awesome. Gotta love the Sierra Nevada on the desk too :) edit: now why in the world is my comment being downvoted?

Usual Suspects: Someone fat fingered an upvote or HN is not always enthusiastic about "Me too!/That's awesome!" no-op comments.

Backup Suspect: Teetotaler/Brogrammer-hater. Doesn't like beer on the desk at work.

Re: CloudFlare's Heartbleed challenge cracked

#49

Post by rubiquity »

fletchowns wrote: post #39
ademarre wrote: post #34

https://twitter.com/eastdakota/status/454792635279220737 Pic of the CloudFlare team reviewing the attack. Ten guys crowded around one monitor.

Hah! That's awesome. Gotta love the Sierra Nevada on the desk too :) edit: now why in the world is my comment being downvoted?

Because HN readers only drink Pliny the Elder and mentioning any other beer is down vote criteria.

Re: CloudFlare's Heartbleed challenge cracked

#50

Post by danielweber »

specto wrote: post #43

Considering he just pulled a shadow file as well, it's not pretty.

I think someone else found that, although he linked to their pic.

Remember, lots of people are pushing up bogus stuff into the heap, so just because you see something there doesn't mean Cloudflare leaked it.

Post reply on HN