We have reached out via twitter to this invidiual as to coordinate the delivery of the $10,000 bounty we offered. If anyone is already in contact with them please direct them to https://news.ycombinator.com/item?id=7572530
CloudFlare's Heartbleed challenge cracked
11–20 of 155 posts
Re: CloudFlare's Heartbleed challenge cracked
#12https://twitter.com/indutny/status/454767565991325697 How do you not love this guy.
[deleted]
Re: CloudFlare's Heartbleed challenge cracked
#13Love to see a post on how it was done and the tools he used.
Re: CloudFlare's Heartbleed challenge cracked
#14https://twitter.com/indutny/status/454767565991325697 How do you not love this guy.
Core node.js dev, based in Moscow, commits open source almost daily, works at Voxer, cracks security for fun. I love the internet.
https://twitter.com/indutny/status/454783660886360064
Just awesome. Only 3 hours to rip out the key!
Re: CloudFlare's Heartbleed challenge cracked
#15Well, so much for wishful thinking.
Re: CloudFlare's Heartbleed challenge cracked
#16So this does mean that I need to change my passwords on every damn site on the list? Oh bollocks, those passwords were a work of art.
No. This means you need to change keys for every ssl service you run. Passwords were known to be leaked earlier.
Really it means (as everyone assumed in the first place) that anything a web server might have in its heap needs to be totally thrown away. Private keys. Passwords. Credit card numbers. Security questions/answers. Sessions.
Anything you'd send to a web server or receive from a web server is presumed compromised.
Re: CloudFlare's Heartbleed challenge cracked
#17https://twitter.com/indutny/status/454767565991325697 How do you not love this guy.
Worked for me running Firefox 28.0 on Linux, no security warnings. Yikes!
Re: CloudFlare's Heartbleed challenge cracked
#18https://twitter.com/indutny/status/454767565991325697 How do you not love this guy.
Can someone elaborate on what's going on here?
If i replace his IP with some other random IP I get a 400 bad request error, so it's obvious that it works, but curious how that resolves.
Re: CloudFlare's Heartbleed challenge cracked
#19https://twitter.com/indutny/status/454767565991325697 How do you not love this guy.
Can someone elaborate on what's going on here? If i replace his IP with some other random IP I get a 400 bad request error, so it's obvious that it works, but curious how that resolves.
Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name.
Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning.
Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.
Re: CloudFlare's Heartbleed challenge cracked
#20Earlier quoted context omitted.
Can someone elaborate on what's going on here? If i replace his IP with some other random IP I get a 400 bad request error, so it's obvious that it works, but curious how that resolves.
Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name. Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning. Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.
But seems like only the http connection is working, i get a warning in Chrome when visiting https://cloudflarechallenge.com. Isn't that the only situation where the key would be checked. That's the part that doesn't make sense.