#open ssl

New Post has been published on http://www.kerrylcacho.com/?p=1564

Anatomy of Heartbleed Bug

By Nilanjan De There has been a lot of buzz about Heartbleed[1] in the news recently. In this blog post, we have tried to put together the important things that one should know about Heartbleed. What is Heartbleed?

Heartbleed is the popular name given to the recently found vulnerability(CVE-2014-0160) in OpenSSL – an open-source encryption library. More specifically, this is a bug in the OpenSSL Heartbeat protocol which results in a vulnerable server to leak or bleed confidential content in its memory space (and hence the name ‘Heartbleed’).

What’s Heartbleed bug?

OpenSSL is the most popular open-source library providing implementations of various cryptographic functions and SSL/TLS protocols. The SSL protocol has a feature called “Heartbeat” using which a client can check whether its connectivity to the server is still present or not. This avoids the overhead of setting up a new SSL connection and thus saves processing power and improves performance. This is done by sending a Heartbeat request with a small payload (data) and the size of the data which is then sent back by the server. (somewhat similar to ICMP echo and reply)

(Read More: 3 Reasons why Automated Vulnerability Scanning does not work)

Unfortunately, some versions of OpenSSL, do not actually check the size of the string sent by the client and trust on the client provided size and sends back the response by copying the block of memory as per the size provided by the client. This can be misused by any rogue client who can request a Heartbeat response with a size more than what it sends as shown in the below comic and thus read a lot bigger chunk of memory (upto 65536 bytes) than it requested. Since OpenSSL handles encryption and decryption, in many cases, the memory may contain confidential plaintext for example usernames, passwords, emails or cryptographic keys which can allow an attacker to decrypt any encrypted traffic encrypted using the key. The bug even affects vulnerable clients which may be attacked by rogue servers.

(Read More: Bypassing Captcha using Python and Tesseract OCR engine)

XKCD has nicely summarized the Heartbleed bug in the following comic in layman terms.

You may also check this video to understand how the attack works.

Download Free Checklist: How to assess your Penetration Testing Vendor?

Who are at risk?

OpenSSL versions 1.0.1 to 1.0.1f(both inclusive) are VULNERABLE

OpenSSL version 1.0.1g is NOT VULNERABLE OpenSSL branch 1.0.0 and 0.9.8 are NOT VULNERABLE

If you are running a vulnerable version of OpenSSL as listed above, you are vulnerable and should immediately take steps to mitigate the risk.

In case you are not sure about your OpenSSL version, you can check your site using the Netcraft browser plugin.

Alternately, you may check your site here or here.

Another option is to run your favourite Vulnerability Assessment tool against your site or get it tested by us or any other Penetration testing vendor.

(Read More: Challenges in automated testing of session management)

What is the fix?

In case you find that your servers are vulnerable to Heartbleed bug, you should do the following: 1.Upgrade to the latest OpenSSL version and any other packages which may have been compiled/linked with OpenSSL. If upgrading is not possible, you need to recompile the older version of OpenSSL using the compile time option -DOPENSSL_NO_HEARTBEATS in order to mitigate the vulnerability. 2.Stop all the affected services. 3.Revoke old certificates and keys and generate new ones. 4.Restart all the affected services 5.Understand your application profile and change any other critical information which you suspect may have been leaked. For example, change all application passwords or force your users to change their passwords at next login.

Note: You need to do the above in the exact order as specified.

For more information, check the official Heartbleed Bug site[2]

(Read More: REST APIs and Next Generation Threats: Part 1)

References:

[1] “Heartbleed – Wikipedia, the free encyclopedia.” 2014. 29 Apr. 2014 <http://en.wikipedia.org/wiki/Heartbleed>

New flaw discovered in Open SSl

This is for the second time within weeks the open SSL has been discovered with a flaw. The first flaw being the “Heartbleed” which terrorized the web and many tech giants has now become an old story as a new flaw known as CCS (ChangeCipherSpec) injection has been discovered.

The main problem is that, this bug existed since the first release of the open SSL. The wrong way of accepting the…

A un mese di distanza dall’esplosione della “bomba” Heartbleed, il numero di server ancora affetti dalla pericolosa vulnerabilità nella libreria OpenSSL ammonta a circa 300.000.

Robert Graham ha individuato i server vulnerabili eseguendo una scansione dei server di rete raggiungibili attraverso la porta 443, scoprendo che il numero di sistemi ancora fallati si era ridotto a circa la metà di quelli scoperti in precedenza e precisamente a 318.239 unità.

Software proprietário vs Software Livre, falha no protocolo de segurança de criptografia SSL põe em dúvida o uso do software livre em grandes corporações

Veja como você pode proteger suas informações contra a falha na criptografia Heartbleed.

Conforme o relatório sobre a descoberta de uma vulnerabilidade importante no Secure Sockets Layer (SSL), serviço de encriptação,que é implementado em algumas versões do Linux, um exploit poderia revelar até 64 kilobytes de memória do servidor afetado.

A boa notícia é que o Projeto OpenSSL emitiu uma correção…

The NSA Knew Of HeartBleed Bug For Two Years And Used It To Spy On The Internet

The NSA knew about the Internet security bug Heartbleed and regularly used it to gather intelligence for at least two years, anonymous sources told Bloomberg.

If the report is true — both the White House and the NSA say it's not  — the NSA could have collected information like passwords and private communications from hundreds of thousands of websites, since Heartbleed is a bug in the popular open-source encryption software OpenSSL, used to secure data flowing from users' computers to hundreds of thousands of websites, including Gmail and Facebook.

Almost two-thirds of all sites on the Internet use OpenSSL, according to estimates, making this bug possibly one of the most dangerous the Internet has ever seen and potentially allowing the NSA to access information on millions of users.

Matthew Prince, the CEO of security firm Cloudflare, tweeted that it's "hard as a tech company today to not feel like we're at war with our own government."

Despite the outrage, this revelation doesn't come as a complete surprise for many. Over the past few days, some have already speculated whether the NSA used Heartbleed to breach SSL, since documents leaked by Edward Snowden revealed the spy agency has been trying to breach it for years.

"It would not at all surprise me if the NSA had discovered this long before the rest of us had," Matt Blaze, a cryptographer and computer security professor at the University of Pennsylvania, told Wired. "It’s certainly something that the NSA would find extremely useful in their arsenal."

Intelligence Agencies Are Happy As Clams Thanks to Heartbleed “Bug”

The Heartbleed “bug” which has affected millions of computer systems and countless hardware devices ranging from telephones, to video conferencing systems, to routers and firewalls –was the result of work done by a German software developer named Robin Seggelmann. Seggelman says it was a coding error that caused Heartbleed, and the error was not “caught” by an auditor inside the Open SSL Project.…