71–80 of 155 posts
https://twitter.com/indutny/status/454767565991325697 How do you not love this guy.
Can someone elaborate on what's going on here? If i replace his IP with some other random IP I get a 400 bad request error, so it's obvious that it works, but curious how that resolves.
Earlier quoted context omitted.
Do you guys store passwords in plain text? Shouldn't you only be able to get password hashes from a vulnerable server? I might be reading too much into your statement, but I'd like to know if I'm misunderstanding the situation.
you are underestimating the severity of the bug. The bug leaks server memory - in which case unencrypted passwords are being sent to the server by the user's browser in order to be hashed to be compared to the hashed versions in storage. Normally this is protected by tls, but as you can see, for servers that suffer from this hole, it's as good as naught. Note that this occurs for "any" connections hitting the vulnera…
The important thing to know here is that you not only have to change your current certs you ALSO HAVE TO REVOKE THE OLD ONE. If you only change your current cert to get a new key but you don't go through the revocation process of the old certificate if someone managed to get the old one they can still use it for a MiTM attack - as both certs would be valid to any client.
Also, cert revocation just barely works, in some browsers, with EV certificates, after old CRLs expire over a course of months: http://news.netcraft.com/archives/2013/05/13/how-certificate...
Earlier quoted context omitted.
Heartbleed doesn't give you access to storage - it gives you access to the raw heap of the process that's linked to OpenSSL. Passwords are typically transmitted unhashed, albeit encrypted by TLS, and the application decrypts the TLS stream to heap, which means an unhashed version of the password is in process memory for some amount of time. An attacker using Heartbleed has a chance to see that memory, and could there…
Example from a memory dump on a vulnerable server (username & password changed to protect the innocent): `..?...t?.R...t> ...ned....userna me=0000000+0ew+0 user&password=my passw0rD.~Jt.... .3z..a.......... One of the things that caught me off guard, but isn't surprising is that some hosting companies don't use VM isolation, thus it was possible to pull memory from other sites which may have been patched. Hopefully h…
Could you explain this please?
Here's a possible scenario... I root virtual machine X running on host Z (using heartbleed). Another machine running on Z is virtual machine Y. Because X and Y are not isolated, and I am running whatever I want on X, I can find some uncleared memory (somehow -- how?) that was previously used by Y, thus giving me access to Y. (Seems a bit handwavy, and I'm not sure this is what you meant, so any details would be helpful.)
--
For some context, I looked up "VM isolation" and found this article which I think sums it up pretty nicely: http://blogs.msdn.com/b/rsa2008/archive/2008/04/07/isolation...
So @indutny sent at least 2.5 million requests, should we start to think more on the practical prevention techniques?
TL:DR, patch OpenSSL and revoke and rekey all your certs.
TRÀ CHANH QUÁN là mạng xã hội – Game online theo lượt dành cho các bạn Teen trên nền điện thoại di động và Smart Phone. nơi chia sẻ cảm xúc, chat chit, video, đăng ảnh, viết tường, chơi game,… game đã nhanh chóng thu hút được hàng triệu lượt bạn trẻ tham gia trên khắp mọi miền đất nước. Ngoài chức năng giống như một mạng xã hội tra chanh quan còn là 1 địa điểm vui chơi giải trí của các bạn trẻ, Thỏa thích chơi các Game Bài cùng bạn bè: Liêng, Phỏm, Tiến lên miền Nam, 3 cây, Tiến lên miền Bắc, 3 cây gà, poker, xito…
https://twitter.com/eastdakota/status/454792635279220737 Pic of the CloudFlare team reviewing the attack. Ten guys crowded around one monitor.
Reading Cloudflare's blog post[0], they keep referring to the exploit having a length of 65,536 bytes, and how an allocation of that size is unlikely to find itself lower in the heap. That is true - but this exploit doesn't depend on setting a length of 65,536. The server takes whatever length the client gives it (which is, afterall, the bug). Most of the early exploits just happen to set the maximum packet size to g…
>we had the bug 16 days early, no we had the bug 18 days early And we didn't know what to do about it... CIA and FBI had knowledge of variations of this vulnerability nearly 10 years ago. OpenSSL has been patching variations of this bug for that whole time, and every good hacker, (and the bad ones) have been exploiting OpenSSL since its creation. https://www.openssl.org/news/secadv_20030930.txt People act surprised,…
Source?
Earlier quoted context omitted.
Can someone elaborate on what's going on here? If i replace his IP with some other random IP I get a 400 bad request error, so it's obvious that it works, but curious how that resolves.
I would call this a "self-induced man in the middle attack". You're telling your computer that cloudflarechallenge.com is his server.