It seems that this is likely to impact OpenVPN too, since it uses TLS - https://openvpn.net/index.php/open-source/337-why-openvpn-us... Using a tls-auth key may help mitigate this (especially if you use UDP) since it should stop anything reaching the TLS handshake layer. https://openvpn.net/index.php/open-source/documentation/howt...
The Heartbleed Bug
461–470 of 547 posts
Re: The Heartbleed Bug
#462Note: if you use mint.com, it's likely hitting your banks with your login on your behalf today. You'll still want to change those passwords even if you didn't use banking sites during the known vulnerability window.
The "known vulnerability window" is over 2 years.
I'm trying to come up with a personal security model that doesn't end with me living in a cabin in the woods.
Re: The Heartbleed Bug
#463Earlier quoted context omitted.
Just a note to others: all crypto includes things like SSH keys, SSH host keys, and GPG keys. Anything in memory could have been read.
Well, I don't think it's anything in memory, but whatever was up to 64k from wherever the downloaded packet was put in userspace (Edit: Er, 64k at a time, but the attacker can try again over and over). Since the kernel should be handing only zeroed pages to userspace to use as a buffer then it should only be memory used by the process using openssl at risk. The big problem is that this is still a gigantic range of pr…
Re: The Heartbleed Bug
#464Earlier quoted context omitted.
Just a note to others: all crypto includes things like SSH keys, SSH host keys, and GPG keys. Anything in memory could have been read.
How would a TLS webserver read the memory of sshd? Processes shouldn't generally have everything mapped in.
Re: The Heartbleed Bug
#465Earlier quoted context omitted.
@stormbrew is correct about ubuntu, use -a or -v -b openssl version -v -b OpenSSL 1.0.1 14 Mar 2012 built on: Wed Jan 8 20:45:51 UTC 2014
I'm totally confused by this. I'm running ubuntu LTS 12.04 and did sudo aptitude update sudo aptitude upgrade openssl and then ran openssl version -a and got the same results as you. How can it be built on January 8th if the patch was just made today? [EDIT] running sudo aptitude upgrade upgraded properly and now I'm getting a version that was compiled earlier today. I'm guessing I needed to update another package as…
Re: The Heartbleed Bug
#466Earlier quoted context omitted.
> The problem with C is that a lot of people don't write it well. Including people responsible for one of the most important security-related library in the world. No matter how good and careful a programmer is, they are still human and prone to errors. Why not put every chance on our side and use languages (e.g. Rust, Ada, ATS, etc.) that make entire classes of errors impossible? They won't fix all problems, and def…
> Why not put every chance on our side and use languages (e.g. Rust, Ada, ATS, etc.) that make entire classes of errors impossible? I don't think intentionally preventing the programmer from doing certain things the computer is capable of doing on the theory it makes errors impossible makes sense. As I've said several times in this thread, somebody has to deal with the pointers and raw memory because that's the way c…
> I don't think intentionally preventing the programmer
> from doing certain things the computer is capable of
> doing on the theory it makes errors impossible makes
> sense.
With arguments like this, we'd all be back in the days of non-structured programming languages (enjoy writing all your crypto in MUMPS). Every modern language, including C, restricts itself in some way in order to make programs more predictable and errors less likely. Some simply impose more restrictions than others, though these restrictions can actually make programs more efficient (see, for instance, alias analysis in Fortran vs. alias analysis in C). > somebody has to deal with the pointers and raw memory
> because that's the way computers work
All three of the languages listed previously (Rust, Ada, ATS) are systems programming languages with the capability of manipulating pointers and raw memory (though I don't personally have any experience with the latter two). What they have in common is that they provide compile-time guarantees that certain aspects of your code are correct: for example, the guarantee that you never attempt to access freed memory. These are static checks that require no runtime to perform, and impose no overhead on running code.Re: The Heartbleed Bug
#467Maybe DigitalOcean issued a fix without me noticing? I also updated my Ubuntu packages, yet OpenSSL is still at 1.0.1.
Re: The Heartbleed Bug
#468Earlier quoted context omitted.
The "known vulnerability window" is over 2 years.
The window in which the vulnerability was publicly known. I'm trying to come up with a personal security model that doesn't end with me living in a cabin in the woods.
Re: The Heartbleed Bug
#469Earlier quoted context omitted.
You may be interested in Quark, which is a browser kernel written using Coq http://goto.ucsd.edu/quark/
Yes, why doesn't the same thing exist for SSL? The fact that quark was funded by the NSF means that there is interest in actually doing stuff like this.
Re: The Heartbleed Bug
#470Common sense says I'm just being silly. I just wonder.