Is this really an accurate challenge? I have wondered if the true exposure risk from Heartbleed may be over-stated* due to memory separation between processes, etc. This however is probably a clean server with a fairly static install. There isn't a risk of things like session leakage which I think is the true risk of Heartbleed. Nor would there be the memory fragmentation that would occur in a production system. Whil…
Much kudos to the guy who cracked it later in the day. I'm glad this proved a useful test. I gladly stand corrected.
Or you can put in a memory area with unmapped sections on both sides if you are paranoid.
True.. I wonder if any specs/certifications actually require something like that. Typically I mostly use tricks like that to track down bugs, but there's nothing wrong with using it in production for something like a single key/cert alloc. It becomes a bit unwieldy if you have lots of things to protect. (Especially on machines with 64k pages :))
Well it seems like Akamai were doing exactly that. If you have lots I would go multi process though.
Note that by visiting, your IP and referer become accessible by anyone running an heartbleed exploit: 93.142.x.x - - [11/Apr/2014:10:44:36 -0400] "GET /heartbleed HTTP/1.1" 200 1148 "https://news.ycombinator.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36"
Whoops, too late. Were you able to get that info from actually running the exploit?
Yes, I was. I extracted access-log entries from 23 unique IPs in a few hours, though most came from a single IP
The article is about Cloudfare saying their keys are safe. We were discussing implications of someone winning the Cloudfare challenge. You suggested the fall of the challenge would confirm Neel being wrong? I was alluding to Neel's position that that any key leaking is "unlikely" - a much more tenuous position than Cloudfare's. But maybe you meant that he's alrady been proven wrong, and the nsa would be another? Then…
Too often you seem lame jokes like the original comment that require the belief that NSA is leaps and bounds ahead of the world in infosec AND yet NSA is composed of bumbling morons. NSA would be grossly incompetent if they knew how to retrieve the private key AND then informed the world of their offensive capability. This is a basic tenet of intelligence operations, you do not publicize your capabilities to your adv…
> leaps and bounds ahead of the world in infosec AND yet NSA is composed of bumbling morons
That's the joke. It's a nutty professor situation.