full-disclosure - Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

Open Source and information security mailing list archives

Message-ID: <20140411070352.GA5254@unser.net>
Date: Fri, 11 Apr 2014 09:03:52 +0200
From: Juergen Christoffel <jc@...er.net>
To: Paul Vixie <paul@...barn.org>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

On Thu, Apr 10, 2014 at 11:32:21PM -0700, Paul Vixie wrote:
> [...]
>really bruce? on a scale of doesn't-matter-at-all to
>worst-thing-you-could-have-previously-imagined, a read only exploit is
>even worse than that?

With all due respect to your ego Paul, I think you might under-estimate the
long term effects: private keys get stolen, this allows people to play
man-in-the-middle, people (the masses) will renew their certificates but
might re-use their generated private keys because the don't know exactly
what they are doing, etc.

As the EFF's traces back into 2013 might tell us, some bad guys exploited
this for some time now. If this is the case, we might soon arrive at the
conclusion that we need to exchange all certificates which had been created
in the last two years.

While I hope it tends to your interpretation, I fear a bit that it might be
Bruces in the long run.

       --jc

-- 
  A great many of today's security technologies are "secure" only because
  no-one has ever bothered attacking them. -- Peter Gutmann

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives