Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Heartbleed could've been found

blog.hboeck.de

Post reply on HN
Print view View original

1–10 of 43 posts

Re: How Heartbleed could've been found

#2

Post by Tomte »

I rhink there's something fishy with it: you overcome several hurdles to fuzz OpenSSL and then - miraculously - you come up with Heartbleed.

And the best of it: only Heartbleed. nothing else. Nothing more.

Looks like it really went that way, but what are the odds?

Re: How Heartbleed could've been found

#4

Post by steakejjs »

Google has a big fuzz-farm and Project Zero looking for this type of thing and even they did not find Heartbleed years ago. They are nabbing tons of bugs but there are many that are simply buried.

This seems to me a bit like when you do a maze starting from the finish and it is, for whatever reason, trivial to go from one end to the other.

It is neat that it is 2015 and fuzzers are cool again, though.

Re: How Heartbleed could've been found

#7

Post by gpvos »

Tomte wrote: post #2

I rhink there's something fishy with it: you overcome several hurdles to fuzz OpenSSL and then - miraculously - you come up with Heartbleed. And the best of it: only Heartbleed. nothing else. Nothing more. Looks like it really went that way, but what are the odds?

The only slightly suspicious thing that he did was that he immediately fuzzed only the first packet and no others. Although, being the first packet, it's a logical place to start. So I think the Heartbleed bug would indeed have been reasonably easy to find with this technology.

Re: How Heartbleed could've been found

#8

Post by sp332 »

steakejjs wrote: post #4

Google has a big fuzz-farm and Project Zero looking for this type of thing and even they did not find Heartbleed years ago. They are nabbing tons of bugs but there are many that are simply buried. This seems to me a bit like when you do a maze starting from the finish and it is, for whatever reason, trivial to go from one end to the other. It is neat that it is 2015 and fuzzers are cool again, though.

Not many people did serious analysis of OpenSSL just because the code was very difficult to debug.
Post reply on HN