full-disclosure - Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

Open Source and information security mailing list archives

Date: Fri, 11 Apr 2014 15:31:07 +0100
From: Manuel Tiago Pereira <mt.pereira@...il.com>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

Hi,

CloudFlare has a very interesting article on their attempts to get a SSL
private key, explaining why they find it very unlikely to be able to get
it. Here it is:
http://blog.cloudflare.com/answering-the-critical-question-can-you-get-private-ssl-keys-using-heartbleed

On Fri, Apr 11, 2014 at 10:45 AM, Paul Vixie <paul@...barn.org> wrote:

>
>
> Juergen Christoffel wrote:
> > On Thu, Apr 10, 2014 at 11:32:21PM -0700, Paul Vixie wrote:
> >> [...]
> >> really bruce? on a scale of doesn't-matter-at-all to
> >> worst-thing-you-could-have-previously-imagined, a read only exploit is
> >> even worse than that?
> >
> > With all due respect to your ego Paul, I think you might
> > under-estimate the
> > long term effects: private keys get stolen, this allows people to play
> > man-in-the-middle, people (the masses) will renew their certificates but
> > might re-use their generated private keys because the don't know exactly
> > what they are doing, etc.
>
> thanks for whatever respect may be due, but bruce is still wrong. the
> cost to fix this is:
>
> 1. replace all private keys
> 2. replace all passwords
> 3. upgrade all SSL software
>
> that rates 9 out of 10, where 10 is the worst thing i could have
> imagined pre-heartbleed, which is remote file modification and/or remote
> code execution, because the costs in that case would be:
>
> 1. inclusive of [1..3] above
> 2. replace all operating systems
> 3. audit or replace all user data
>
> > As the EFF's traces back into 2013 might tell us, some bad guys exploited
> > this for some time now. If this is the case, we might soon arrive at the
> > conclusion that we need to exchange all certificates which had been
> > created
> > in the last two years.
>
> we already have to do that, since we have to assume the worst whenever
> we don't have log files which somehow prove a negative.
>
> >
> > While I hope it tends to your interpretation, I fear a bit that it
> > might be
> > Bruces in the long run.
>
> bruce was spouting nonsense. heartbleed's costs will not be higher than
> previously imaginable.
>
> vixie
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/
>

-- 
Manuel Tiago Pereira

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives