full-disclosure - Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

Open Source and information security mailing list archives

Message-ID: <14263468.C2JJa35zUv@pandora>
Date: Fri, 11 Apr 2014 21:52:51 +0200
From: Joerg Mertin <smurphy@...sys.org>
To: fulldisclosure@...lists.org
Subject: Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

When I first heard it, I suspected that there was something more behind it.
Thing is - as secret services are not able to actually brute-force encryption, 
they needed to find a way around. And the only one way around was to either 
use existing bugs/weaknesses, or implant some (as NIST).

http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html

Don't you guys feel that in the last 12 months, there are very many bugs 
related to SSL showing up ?

IMHO that is not a coincidence... these are too many for me to believe this is 
coincidence. I really believe that some secret service agencies have made sure 
that certain weaknesses are implanted or if discovered, remain where they are 
(in the dark) so they can actually use these if required.

The best about that is the media coverage. I have rarely (except when I hear 
politicians talk) heard so much junk in so short sentences.

On Tuesday 08 April 2014 03:10:06 Kirils Solovjovs wrote:
> We are doomed.
> 
> Description: http://www.openssl.org/news/vulnerabilities.html
> Article dedicated to the bug: http://heartbleed.com/
> Tool to check if TLS heartbeat extension is supported:
> http://possible.lv/tools/hb/
> 
> A missing bounds check in the handling of the TLS heartbeat extension
> can be used to reveal up to 64kB of memory to a connected client or server.
> 
> 1.0.1[ abcdef] affected.

-- 
You can no more win a war than you can win an earthquake.
		-- Jeannette Rankin
------------------------------------------------------------------------
Joerg Mertin in Clermont/France
Web: http://www.solsys.org
PGP: Public Key Server - Get "0x159DC660F946126F"

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives