Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

github.com

Post reply on HN
Print view View original

61–70 of 78 posts

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#61

Post by vezzy-fnord »

danielweber wrote: post #26
eli wrote: post #19

Earlier quoted context omitted.

I would imagine the motivation is less about money and more about having fun breaking stuff (and bragging rights). I agree though. Hard to argue that this particular security issue needed any extra attention in order to get it fixed.

One of the biggest root causes of problems in the security industry is that often the only way to make a name for yourself is to cause pain to others. (It's not too hard to convince yourself that those others deserved it.) If you went back in time two years and fixed the Heartbleed bug, no one would be writing newspaper articles about you.

If you went back in time two years and fixed the Heartbleed bug, no one would be writing newspaper articles about you.

This is hardly something isolated to the security industry. It's human nature. Some person sealing a hole is nowhere near as attention-gathering as a hole leading to a catastrophic flood due to no one realizing that it needs to be sealed.

The potential for something bad to happen doesn't raise anywhere near as much eyebrows as the bad thing actually happening, especially for something as invisible to the average person as a software vulnerability.

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#62

Post by LukeShu »

nikcub wrote: post #28
neals wrote: post #3

I have a few ubuntu servers. When I do a "check for heartbleed" check with various tools, it says they are not vulnerable. However, these servers were installed 6 months ago and not updated for at least 2 months. How can they not be vulnerable?

Most reports about Heartbleed kept repeating that the vulnerability was introduced 2 years ago (Dec '12, which isn't even 2 years - but anyway) it was committed to a version of OpenSSL (v1.0.1) that wasn't widely distributed until the middle of last year. The time surface of the Heartbleed attack is a lot smaller than what most think. Debian and the BSD projects moved to v1.0.1 earliest, around March/April last year.…

    > 2 years ago (Dec '12, which isn't even 2 years - but
    > anyway)
It was Dec 31 '11, not '12, that the commit was made--more than 2 years ago. It first appeared in the OpenSSL 1.0.1 release; March 14, 2012.

I don't know what's up with the timestamp on the Ubuntu announcement, but 12.04 was released in April 2012.

However, that's before the OpenSSL 1.0.1 date; the Ubuntu 12.04.4 update for openssl 1.0.1-2ubuntu1 came on March 22, 2012.

No matter how you slice it, that's more than 2 years.

Edit: Ubuntu 12.04 was April 2012, but the 12.04.4 point-release was released at the later date; that's where the 2014 date came from. 12.04 included OpenSSL 1.0.1 before that.

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#63

Post by vezzy-fnord »

larrys wrote: post #60
djcapelis wrote: post #43

Earlier quoted context omitted.

Everytime someone writes a tool to show what is possible in public, there's some jerk giving them a hard time about it. Don't be that jerk. The function of the security community is to help people realize when they're not safe. No one likes having their bubble burst, but it's important that it get burst or people don't fix the problems. We've seen this over, and over, and over. Find a good way to improve security tha…

"The function of the security community is to help people realize" You say that because you are not on the other end of this and don't suffer any of the consequences as a result of the actions of people who create some of these things which make it for sure easier for more people to exploit systems. Please don't take this as an attack but your perspective is based upon your job [1] and your apparent lack of exposure…

I mean the end users of the technology. Who in no way are in a position to get the vendors to do anything or make things more secure, in general.

Writing offensive security tools is bound to get the attention of the vendors, to cause a storm that will get attention from the vendors.

What you're advocating amounts to shooting the messenger. How dare some person write software that disrupts your falsely ingrained peace of mind.

The fact of the matter is, vendors have been notorious throughout the ages for not listening to the security community. So many easily preventable mistakes have led to so many breaches.

Well, it's time to get people to listen. What better way to do that then demonstrate, first-hand, the gravity of their errors?

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#64

Post by clogston »

makomk wrote: post #30
eli wrote: post #19

Earlier quoted context omitted.

I would imagine the motivation is less about money and more about having fun breaking stuff (and bragging rights). I agree though. Hard to argue that this particular security issue needed any extra attention in order to get it fixed.

It's quite easy to argue that actually. People pointed out that those Snort and other IDS rules were inadequate as soon as they were released, yet it hasn't stopped vendors from claiming they offer protection.

"yet it hasn't stopped vendors from claiming they offer protection"

100% true. The argument Dan and others are trying to make is there are a lot of people caught in the cross-fire who have nothing to do with IDS-vendors claims.

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#65

Post by clogston »

rdl wrote: post #45
danielweber wrote: post #17

This should be a useful tool on its own, but I wrote it primarily because the pattern-matching rules for Snort are inadequate. IDS vendors won't fix their stuff until I can prove they are inadequate. Ugh. In the old days the mantra of full-disclosure was "well, if we don't make exploit tools, then the vendors won't issue patches." And then it became "well, if we don't make exploit tools, then the sysadmins won't patc…

End users are more likely to pressure their vendors for better security in the future if they suffer more pain today.

"End users are more likely to pressure their vendors for better security in the future if they suffer more pain today."

Your statement is true, but surely there's a better and less damaging way to reach the end goal? e.g., if I run over someone with my car and they're saddled with life-long medical bills, they're more likely to call their Congressman and demand a better healthcare system.

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#66

Post by moyix »

larrys wrote: post #60
djcapelis wrote: post #43

Earlier quoted context omitted.

Everytime someone writes a tool to show what is possible in public, there's some jerk giving them a hard time about it. Don't be that jerk. The function of the security community is to help people realize when they're not safe. No one likes having their bubble burst, but it's important that it get burst or people don't fix the problems. We've seen this over, and over, and over. Find a good way to improve security tha…

"The function of the security community is to help people realize" You say that because you are not on the other end of this and don't suffer any of the consequences as a result of the actions of people who create some of these things which make it for sure easier for more people to exploit systems. Please don't take this as an attack but your perspective is based upon your job [1] and your apparent lack of exposure…

I'd like to offer a different perspective. You're free to dismiss me as well because I currently have a similar job description to 'djcapelis, but I've also been a sysadmin and front-line IT security guy (watching IDSes, patching systems), so I have a pretty good idea what the commoditization of exploit code means.

I think that things like metasploit and heartleech are an almost purely unalloyed good. In my experience, the "bad guys" already have easy-to-use tools. What publicly available tools do is give defenders access to these techniques, which they can use to demonstrate that problems really are a Big Deal. There is a certain kind of person (who seem to gravitate towards management) that cannot be convinced to take an issue seriously unless they can see the impact with their own eyes. A tool that prints out the private key of their production server is worth a dozen blog posts and security advisories as far as convincing them the danger is real.

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#67

Post by diminoten »

danielweber wrote: post #17

This should be a useful tool on its own, but I wrote it primarily because the pattern-matching rules for Snort are inadequate. IDS vendors won't fix their stuff until I can prove they are inadequate. Ugh. In the old days the mantra of full-disclosure was "well, if we don't make exploit tools, then the vendors won't issue patches." And then it became "well, if we don't make exploit tools, then the sysadmins won't patc…

This smells of anti-sec nonsense to me.

More information is always, always better, and hiding information and implementation has been proven, over and over again, to not work, and to piss people off.

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#68

Post by robertgraham »

danielweber wrote: post #17

This should be a useful tool on its own, but I wrote it primarily because the pattern-matching rules for Snort are inadequate. IDS vendors won't fix their stuff until I can prove they are inadequate. Ugh. In the old days the mantra of full-disclosure was "well, if we don't make exploit tools, then the vendors won't issue patches." And then it became "well, if we don't make exploit tools, then the sysadmins won't patc…

This isn't true.

One of the things I'm famous for is creating "BlackICE" 15 years ago, an intrusion-detection technology that we shipped as a variety of products, such as a personal firewall, gigabit IDS, and inline protection (i.e. intrusion-prevention-system or IPS).

The distinguishing feature of this technology is that we wrote "protocol-decodes" for everything. This made the product faster, able to catch more things, yet producing fewer false-positives. It's a vastly better technique than Snort-style pattern-matching.

Yet, it was an uphill battle convincing the market of this. That's because people are stupid and don't understand how things work well enough to appreciate the difference. All they know is that they download a public exploit, run it, and if the IDS catches it, then the IDS is good.

Today, there are lots of commercial products that do things the right way, with protocol decodes. There is also the open-source "Bro" project which does things the right way. All these products can catch my heartleech tool -- it can't evade tools doing things the right way.

Even Snort often does things the right way, but only when people like me prod them. They are going to add an SSL decode (I predict).

So the upshot is this: I really are about the difference between protocol-analysis and pattern-matching in IDS technology, and as long as people like you aren't smart enough to understand the difference, I'm going to keep releasing exploits to demonstrate it. None of my exploits evade properly written IDS -- only IDS that takes shortcuts.

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#69

Post by robertgraham »

moyix wrote: post #66
larrys wrote: post #60

Earlier quoted context omitted.

"The function of the security community is to help people realize" You say that because you are not on the other end of this and don't suffer any of the consequences as a result of the actions of people who create some of these things which make it for sure easier for more people to exploit systems. Please don't take this as an attack but your perspective is based upon your job [1] and your apparent lack of exposure…

I'd like to offer a different perspective. You're free to dismiss me as well because I currently have a similar job description to 'djcapelis, but I've also been a sysadmin and front-line IT security guy (watching IDSes, patching systems), so I have a pretty good idea what the commoditization of exploit code means. I think that things like metasploit and heartleech are an almost purely unalloyed good. In my experienc…

Yup.

Getting a private key using the extent simple scrypts is quite complicated, with lots of difficult steps. This is no barrier to teenage kids, who has lots of time on their hands that can play around until they get things right.

As a defender, however, you don't have that much time. For you, it's really easy. If you have a server, and want to know if the private key is visible, just download the Windows heartleech binary from github, run it against a server, walk away for 10 hours, and then come back to see if it's gotten the key.

In short, as you say, a tool that effortlessly prints the private key of a production server is worth a bazillion blogposts and security advisories. Code or GTFO, IMO :)

Re: Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

#70

Post by robertgraham »

danielweber wrote: post #26
eli wrote: post #19

Earlier quoted context omitted.

I would imagine the motivation is less about money and more about having fun breaking stuff (and bragging rights). I agree though. Hard to argue that this particular security issue needed any extra attention in order to get it fixed.

One of the biggest root causes of problems in the security industry is that often the only way to make a name for yourself is to cause pain to others. (It's not too hard to convince yourself that those others deserved it.) If you went back in time two years and fixed the Heartbleed bug, no one would be writing newspaper articles about you.

Nobody is writing articles at Neel Mehta, the guy who discovered the bug. They should, he's a god.
Post reply on HN