The "Heartbleed Bug" --new cyber threat. All you techy types, please weigh in.

Albedo · Apr 11, 2014

*cashes NSA cheque*

heza · Apr 11, 2014

I'm troubled that I use several of the big services named and I have received no email of any kind from anyone about changing my password or watching for suspicious activity....

William Haskins · Apr 11, 2014

The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said.

The NSA’s decision to keep the bug secret in pursuit of national security interests threatens to renew the rancorous debate over the role of the government’s top computer experts.

http://www.bloomberg.com/news/2014-...e-used-heartbleed-bug-exposing-consumers.html

raburrell · Apr 11, 2014

I am ever so shocked by that revelation

:sarcasm

sigh.

kuwisdelu · Apr 11, 2014

But if the NSA has been exploiting Heartbleed for “at least two years,” the agency would have needed to discover it not long after the code for the TLS Heartbeat Extension was added to OpenSSL 1.0.1, which was released on March 14, 2012. The first “beta” source code wasn’t available until January 3, 2012.

That means that the agency would have had to learn of the flaw in the code within days of its full release at the latest. While not impossible, that possibility seems highly unlikely unless the NSA dedicated resources to follow the project while in development, watched changes in code, and did ongoing extensive analysis. According to budget documents published by the Washington Post in August 2013, the NSA spent $25 million in 2013 on zero-day exploits from “private vendors.”

http://arstechnica.com/security/2014/04/nsa-used-heartbleed-nearly-from-the-start-report-claims/

kuwisdelu · Apr 11, 2014

I'll wait to believe it until we get a better source.

The NSA would have to have been watching OpenSSL pretty closely to find the bug so quickly — which is not unlikely.

If they really did know about it, I'd say that's worse than just about everything else we know they've done combined.

It would be reckless endangerment of American businesses and citizens.

They'd be culpable for putting national security at risk rather than defending it.

Torgo · Apr 11, 2014

kuwisdelu said:
I'll wait to believe it until we get a better source.

The NSA would have to have been watching OpenSSL pretty closely to find the bug so quickly — which is not unlikely.

If they really did know about it, I'd say that's worse than just about everything else we know they've done combined.

It would be reckless endangerment of American businesses and citizens.

They'd be culpable for putting national security at risk rather than defending it.

I wouldn't be remotely surprised that they

a) realised the significance of the exploit years ago and have been merrily slurping whatever they could get

b) have just realised the significance of the exploit, but have slurped so much relevant data that they can retrospectively check it out for useful tidbits

benbradley · Apr 11, 2014

NSA denies knowing about Heartbleed:

“NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report. Reports that say otherwise are wrong,” NSA spokesperson Vanee’ Vines told TIME.

http://time.com/60082/nsa-heartbleed-bug-denial/

Don · Apr 11, 2014

benbradley said:
NSA denies knowing about Heartbleed:

http://time.com/60082/nsa-heartbleed-bug-denial/

OTOH, the NSA's credibility is nothing to write home about.

kuwisdelu · Apr 12, 2014

benbradley said:
NSA denies knowing about Heartbleed

Yeah, that's in the story I quoted too, but I figured it was so irrelevant I didn't bother quoting that part.

Whether they did or didn't, what else are they going to say?

benbradley · Apr 12, 2014

kuwisdelu said:
Yeah, that's in the story I quoted too, but I figured it was so irrelevant I didn't bother quoting that part.

Whether they did or didn't, what else are they going to say?

I suppose NSA's choice is to deny it or to be silent.

It does seem it was quite fast in denying it, almost as if the denial were pre-written.

William Haskins · Apr 12, 2014

WASHINGTON — Stepping into a heated debate within the nation’s intelligence agencies, President Obama has decided that when the National Security Agency discovers major flaws in Internet security, it should — in most circumstances — reveal them to assure that they will be fixed, rather than keep mum so that the flaws can be used in espionage or cyberattacks, senior administration officials said Saturday.

But Mr. Obama carved a broad exception for “a clear national security or law enforcement need,” the officials said, a loophole that is likely to allow the N.S.A. to continue to exploit security flaws both to crack encryption on the Internet and to design cyberweapons.

The White House has never publicly detailed Mr. Obama’s decision, which he made in January as he began a three-month review of recommendations by a presidential advisory committee on what to do in response to recent disclosures about the National Security Agency.

http://www.nytimes.com/2014/04/13/u...xploit-some-internet-flaws-officials-say.html

kuwisdelu · Apr 12, 2014

I think it is understandable that not every vulnerability should get disclosed publicly as soon as it is discovered. Sometimes that is necessary for the greater good of security.

What should not happen is keeping vulnerabilities secret from the software writers, too. There needs to be cooperation and communication there.

If the NSA knew about this, they should have told the OpenSSL guys. If they wanted to exploit it against a legitimate threat, they should have asked for the cooperation of the OpenSSL team. It should have been at the discretion of the OpenSSL team what to do.

If the NSA expects any kind of cooperation in the future, they need to foster good faith in the tech community.

They have actively done the opposite.

Williebee · Apr 13, 2014

Torgo said:
Hey, just to say:

This is also a golden opportunity for phishing, so when you get emails telling you to change your password, DO CHECK that they're legit. You don't want to follow a link to something that only looks like your online banking site, and hand over all your credentials.

In my professional opinion:

The bug's a real thing. Even if it wasn't, it's a healthy reminder of paying attention to our own online safety.

We should be changing our passwords regularly anyway. (pot meet kettle)

But the quoted passage above? That's the where the casual/naive internet user is likely to get bit in the coming weeks and months. Encouraging people to read and think before clicking is an "always on" mission.

benbradley · Apr 13, 2014

Williebee said:
In my professional opinion:

The bug's a real thing. Even if it wasn't, it's a healthy reminder of paying attention to our own online safety.

We should be changing our passwords regularly anyway. (pot meet kettle)

But the quoted passage above? That's the where the casual/naive internet user is likely to get bit in the coming weeks and months. Encouraging people to read and think before clicking is an "always on" mission.

I've known people who do not know how to type a domain into the address bar of a browser (if anything, they type keywords of what they want, and rather than erroring out, the browser does a search on the keyword and opens the first result - they get what they want most the time, so they believe they did the right thing). They don't know the difference between clicking on a popup ad, clicking a link in an email, or whatnot. These people can be told to "think" and "be careful" but they don't the basic knowledge to make such statements helpful.

I'm concerned that it takes too little knowledge to be able to do a first-approximation of negotiating the Web.

PeteMC · Apr 15, 2014

Given that Heartbleed has been wild for over two years now, if the NSA really didn't know about it until it went public I think the American people ought to be asking for a refund of their govt funding....

thothguard51 · Apr 15, 2014

List of company's that have patched the Heartbleed open SSL issue...

http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/

If you pull up the list you will see Dropbox and Wordpress is on the list, but Wordpress is rather unclear if there is a fix...

Also, most of Google's services were affected but not Chrome...

PeteMC · Apr 15, 2014

So, in brief summary - regulated financial organisations don't use OpenSSL (largely due to mostly having their IT outsourced to people who know better). This is good to know. Instagram/Pinterest/Tumblr...not so much. Google, shame on you. Yahoo - do you still exist??

benbradley · Apr 15, 2014

PeteMC said:
So, in brief summary - regulated financial organisations don't use OpenSSL (largely due to mostly having their IT outsourced to people who know better).

I'd suspect it's so they have a private entity to sue and place the blame on if such a bug were found in THEIR SSL software.

PeteMC · Apr 16, 2014

Exactly, which is a big part of the definition of "knowing better". Proprietary software often (usually?) isn't any better than open source, but it does give you a vendor's throat to choke if it goes wrong.

Torgo · Apr 16, 2014

Isn't it generally a good idea to use open-source crypto? In that you're not relying on security through obscurity, but on stuff that is exposed to the scrutiny of everyone?

PeteMC · Apr 16, 2014

For small businesses yes, probably. Big companies (banks, insurance companies etc) need to have contractual support contracts, service level agreements, penalty clauses etc with software vendors and service providers, and you don't get that with open source products. Well you sort of do with RHEL etc, but that's not the same thing.

robjvargas · Apr 16, 2014

Torgo said:
Isn't it generally a good idea to use open-source crypto? In that you're not relying on security through obscurity, but on stuff that is exposed to the scrutiny of everyone?

I think that's overblown. Look at this issue. It passed at least two levels of scrutiny and stood for two+ years.

There is, however, some truth to what you said as well.

Using open source software allows you as a client to examine the code for yourself, and to customize it. Software that uses the GPL licensing also enables (and demands, to an extent) sharing among users. And I believe that OpenSSL, the software affected here, uses GPL.

Open source software has its place. I like Microsoft's SQL, but MySQL and even PostgreSQL open source database software powers some of the largest databases on the planet.

There's no reason to deny open source software. Vendors are out there who will provide the same assurance of support and coverage as with closed-source (proprietary) software. And in some cases even more, since those vendors are free to change the software code to suit a particular need.

But Heartbleed should remind us all that no one method is perfect.

robjvargas · Apr 21, 2014

It's a bit technical, but here's a decent article on one acknowledged attack using the Heartbleed vulnerability.

Basically, by using this attack, a hacker was able hijack VPN sessions in progress and bypass two-factor authentication.

According to a DarkReading flash poll, as of Friday, 60 percent of respondents said they've installed Heartbleed fixes on servers, although only about 40 percent said they'd replace digital certificates, and just 30 percent planned to force users to change their passwords.

I'm not real happy with that. The password thing, primarily.

PeteMC · Apr 21, 2014

On the face of it that's pretty crappy, but who were the respondents? Big companies usually won't even answer questions like that, and if they do it's only to demonstrate to their customers that all is well. If the "comments admin" on MomAndPopsGrocercyBlog.com aren't making users change their password.... does it really matter?

Because no one uses the same password for every site they visit, right? Right?

The "Heartbleed Bug" --new cyber threat. All you techy types, please weigh in.

Alex

poet

Treguna Makoidees Trecorum SadisDee

Revolutionize the World

Revolutionize the World

Formerly Phantom of Krankor.

It's a doggy dog world

All Living is Local

Revolutionize the World

It's a doggy dog world

poet

Revolutionize the World

Capeless, wingless, & yet I fly.

It's a doggy dog world

@PeteMC666

A Gentleman of a refined age...

@PeteMC666

It's a doggy dog world

@PeteMC666

Formerly Phantom of Krankor.

@PeteMC666

@PeteMC666