What You Need To Know About Heartbleed, the New Security Bug Scaring the Internet

[Poke]

Must read.

http://news.msn.com/science-technol...d-the-new-security-bug-scaring-the-internet-1

 

[mike123abc]

It looks like a lot of servers will need patching... Probably a convenient exploit the NSA was using.

 

[Poke]

Yeah sounds like Yahoo fixing their stuff.

http://www.theverge.com/2014/4/8/5594266/how-heartbleed-broke-the-internet

 

[mike123abc]

It is surprising that open code goes so long without a major flaw like this being spotted.

 

[mike123abc]

http://blogs.wsj.com/personal-techn...today/?mod=WSJ_hpp_MIDDLENexttoWhatsNewsThird

Currently a free article from the WSJ. They suggest you change your yahoo.com password today since Yahoo just patched their servers.

 

[Foxbat]

What You Need To Know About Heartbleed, the New Security Bug Scaring the Inte...

On the "Security Now" podcast on the TWiT network, Steve Gibson went into this in detail. Since the data returned from a server could contain almost anything, speeding to get the servers patched is Job 1. Not all sites were affected (IIS doesn't use the OpenSSL code) but enough do. If you reuse passwords on several sites, you would be wise to update it on those sites that have patched their servers.

Here's the link to the podcast: http://twit.tv/show/security-now/450
And the transcript (Heartbleed coverage starts on page 12) https://www.grc.com/sn/sn-450.pdf

—Roland

 

[Foxbat]

What You Need To Know About Heartbleed, the New Security Bug Scaring the Inte...

SSLLabs (http://SSLLabs.com) has a tool to check the websites you might visit to see if they are vulnerable or have patched. (The freakin' ads that pop up on the SatelliteGuys app make it impossible to add a photo to a posted entry.) So, a new post to show the SSLLabs scan of this website:

—Roland

 

[Scott Greczkowski]

Are you on an iphone? If yes a new ad free version of the SatelliteGuys reader has been sent to apple, I am just waiting for them to release it.

 

[Foxbat]

What You Need To Know About Heartbleed, the New Security Bug Scaring the Inte...

Are you on an iphone? If yes a new ad free version of the SatelliteGuys reader has been sent to apple, I am just waiting for them to release it.

I'm using my wife's iPad Air. My iPhone has the app, but I was able to log in on that for Web View so I don't get bombarded with the ads.

—Roland

 

[John Kotches]

It looks like a lot of servers will need patching... Probably a convenient exploit the NSA was using.

This is one of those rare times when not being up to date was advantageous.

 

[John Kotches]

I updated my Raspberry PI last night.

For those running SSL services on Mac OS X, according to my check, the OpenSSL version is not vulnerable:

server:downloads jkotches$ openssl version
OpenSSL 0.9.8y 5 Feb 2013
server:downloads jkotches$

v1.0 < 1.0g are vulnerable.

 

[mike123abc]

This is one of those rare times when not being up to date was advantageous.

If you were 2 years old in your patching...

 

[John Kotches]

If you were 2 years old in your patching...

When you are dramatically understaffed, as many organizations are these days... Guess what falls by the wayside?

Sent from my SCH-I605 using Tapatalk

 

[Kraven]

CBC reporting someone took over 900 Canadian social insurance numbers and other personal information from the Canada Revenue Site.

 

[LER]

And for why it wasn't found, the OpenSSL foundation guys also say it's due to lack of manpower. This was stated in a post to the OpenSSL users mailing list. I can get the exact message-id/quote if needed.

With complex software, it's easy for little things to escape notice.

Crypto software is HARD, folks.

 

[mike123abc]

And for why it wasn't found, the OpenSSL foundation guys also say it's due to lack of manpower. This was stated in a post to the OpenSSL users mailing list. I can get the exact message-id/quote if needed.

With complex software, it's easy for little things to escape notice.

Crypto software is HARD, folks.

Well that plus it was just like 4 volunteers working on the project. It was not being maintained by a company with software testing and review procedures.

 

[Foxbat]

I also read the apology from the German developer who accidentally introduced the bug minutes before midnight New Year's Eve 2012. http://www.theguardian.com/technology/2014/apr/11/heartbleed-developer-error-regrets-oversight

 

[mike123abc]

It is one of the problems of open source code. People believe it to be safe since it is open source. But, that makes the grand assumption that people actually study it and review it instead of perhaps just giving it a glance to be sure it is not doing something really evil and deploying it. So, it took 2 years for someone to notice this...

 

[Kraven]

http://www.cbc.ca/news/politics/heartbleed-bug-accused-charged-by-rcmp-after-sin-breach-1.2612526

Canada's RCMP traced and charged a 19 year old w/ stealing 900 SIN's and other personal information off Canada Revenue's site.
Faces a max of 10 year in prison... not long enough IMO.

I wouldnt be suprised that the 19 year old just tried to do it for giggles and had no intent on using the info.

 

[Teehar]

http://www.cbc.ca/news/politics/heartbleed-bug-accused-charged-by-rcmp-after-sin-breach-1.2612526

Canada's RCMP traced and charged a 19 year old w/ stealing 900 SIN's and other personal information off Canada Revenue's site.
Faces a max of 10 year in prison... not long enough IMO.

I wouldnt be suprised that the 19 year old just tried to do it for giggles and had no intent on using the info.

He'll end up working for the govt. instead of serving time.