1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

News Web hit by OpenSSL 'Heartbleed' vulnerability

Discussion in 'Article Discussion' started by Gareth Halfacree, 8 Apr 2014.

  1. Gareth Halfacree

    Gareth Halfacree WIIGII! Lover of bit-tech Administrator Super Moderator Moderator

    Joined:
    4 Dec 2007
    Posts:
    17,365
    Likes Received:
    7,188
    Gareth Halfacree, 8 Apr 2014
    #1
  2. bigc90210

    bigc90210 Teh C

    Joined:
    7 Oct 2003
    Posts:
    1,262
    Likes Received:
    71
    This is the reason the minecraft login servers are down :/
     
    bigc90210, 8 Apr 2014
    #2
  3. Gareth Halfacree

    Gareth Halfacree WIIGII! Lover of bit-tech Administrator Super Moderator Moderator

    Joined:
    4 Dec 2007
    Posts:
    17,365
    Likes Received:
    7,188
    Any company that doesn't take its vulnerable servers down until they're patched (yes, like you, Yahoo, you naughty little company you) is doing its customers a distinct disservice; I can't stress enough how serious this vulnerability is. We're talking the keys to the kingdom, here; total and unfettered (read-only, I'll grant you) access to the contents of RAM. The sysadmin in me is puckering up just thinking about it.
     
    Gareth Halfacree, 8 Apr 2014
    #3
  4. bigc90210

    bigc90210 Teh C

    Joined:
    7 Oct 2003
    Posts:
    1,262
    Likes Received:
    71
    Absolutely agree, they've just announced on Twitter that the servers are coming back up now

    Sent from my GT-I9505 using Tapatalk
     
    bigc90210, 8 Apr 2014
    #4
  5. Umbra

    Umbra What's a Dremel?

    Joined:
    18 Nov 2013
    Posts:
    636
    Likes Received:
    17
    Would NSA/GCHQ tell anyone if they knew?
     
    Umbra, 8 Apr 2014
    #5
  6. mi1ez

    mi1ez Modder

    Joined:
    11 Jun 2009
    Posts:
    1,639
    Likes Received:
    115
    Oh, wow.
     
    mi1ez, 8 Apr 2014
    #6
  7. r3loaded

    r3loaded Minimodder

    Joined:
    25 Jul 2010
    Posts:
    1,095
    Likes Received:
    31
    Definitely not. It's impossible to know whether they knew about this bug beforehand, but at least we're lucky now that a security researcher discovered this one.
     
    r3loaded, 9 Apr 2014
    #7
  8. will_123

    will_123 Small childs brain in a big body

    Joined:
    2 Feb 2011
    Posts:
    1,060
    Likes Received:
    15
    As im aware OpenBSD was not actually affected due to the way they have implemented memory allocation in BSD. Instead of leaking the memory it initiates a dump file or crash I think. In my very first job at NHS as a student sys admin my manager swore by BSD. Maybe he was right!

    Very interesting link below mail thread with openBSD founder replying.

    Mail Thread
     
    will_123, 11 Apr 2014
    #8
  9. Gareth Halfacree

    Gareth Halfacree WIIGII! Lover of bit-tech Administrator Super Moderator Moderator

    Joined:
    4 Dec 2007
    Posts:
    17,365
    Likes Received:
    7,188
    Sadly, if you re-read the link, you'll see that OpenBSD (and all other BSDs shipping affected OpenSSL variants) was affected. Basically, there is exploit mitigation in malloc which means that OpenSSL should crash instead of revealing its secrets; unfortunately, there's exploit mitigation mitigation in OpenSSL that means malloc doesn't get a look-in. (Basically, for performance reasons on one unnamed platform, a coder added internal caching to OpenSSL which bypasses malloc - meaning that the crash-instead-of-leaking feature never gets used, and the data is leaked instead.)
     
    Gareth Halfacree, 11 Apr 2014
    #9
  10. will_123

    will_123 Small childs brain in a big body

    Joined:
    2 Feb 2011
    Posts:
    1,060
    Likes Received:
    15
    ah I misinterpreted it!

    Cheers.
     
    will_123, 11 Apr 2014
    #10
  11. RTT

    RTT #parp

    Joined:
    12 Mar 2001
    Posts:
    14,120
    Likes Received:
    74
    What's crap is that it's widely understood and considered that OpenSSL is a bit of a mess - and the team who run it aren't exactly open to accepting any help. A choice quotes from a thread on r/programming:

    ... which is a shame, because while you probably wouldn't want any old joe submitting patches to such sensitive software, you absolutely could have less-qualified/trusted/whatever engineers start to unit test & fuzz-test the heck out of it
     
    RTT, 11 Apr 2014
    #11
Tags: Edit

Share This Page