4 ms·
i understand not every piece of software can be updated, but when something like heart bleed was release - correct me if i am wrong here - but millions of machi
by misiti3780 11y ago
i understand not every piece of software can be updated, but when something like heart bleed was release - correct me if i am wrong here - but millions of machines were updated.
if i read this article correctly, if we could update millions of computers in a short period of time with a new prime number that would be enough to solve this problem in the short term - long term all we need to do is change the prime number every X number of months, were X would require billions (as opposed to hundreds of millions) of dollars to solve
- tptacek 11y agoThat was one specific piece of software, the overwhelming majority of deployments of which were on machines that could be updated easily. Weak DH parameters for TLS are deployed in tens of thousands of middleboxes that are not easily updated.
- misiti3780 11y agook that makes sense ... thank you
- BinaryIdiot 11y agoThanks for that explanation; I had thought similar to the parent until I read this and it just "clicked".
- azinman2 11y agoThat and you could be attacked by anyone easily. Most ordinary people don't have the NSA as a problem in their treat model compared to the Internet at large.
- javajosh 11y agoWell, that is sounds plausible but hard to prove. And I don't know what you mean by "middle boxes", especially that would be involved with DH. Most boxes other than endpoint and client are only doing TCP. And if I'm wrong I desperately want to know!
- ChristianBundy 11y agoYou're right, except that every "middle box" has both endpoint s and clients. HTTPS, FTP, SSH, IRC, all sorts of databases, caches, queue servers, task runners, announce servers, everything. DH is used any time you're leaving your box.
- tptacek 11y agoMiddlebox = proxy.
- dogma1138 11y agoThere are still millions of machines that affected with HB. And HB was different it was 1 single software and only limited versions, so if you haven't updated OpenSSL for about 2 years there was a good chance you weren't affected in the first place. There are probably 1000's of various DH implementations that are utter crap, it's not like you can release a single advisory and make big news about it.
- tedunangst 11y agohttp://www.eweek.com/security/three-out-of-four-companies-still-vulnerable-to-heartbleed.html http://www.eweek.com/security/three-out-of-four-companies-st... http://www.ft.com/cms/s/0/279eff74-a00d-11e4-9a74-00144feab7de.html http://www.ft.com/cms/s/0/279eff74-a00d-11e4-9a74-00144feab7...
- agwa 11y agoNote that the findings referenced by your first link are total B.S.: http://blog.erratasec.com/2015/04/no-75-are-not-vulnerable-to-heartbleed.html http://blog.erratasec.com/2015/04/no-75-are-not-vulnerable-t...
- tedunangst 11y agoI think that may be the link I wanted, actually, but I took what I found after a quick search. Anyway, Heartbleed wasn't quite fixed overnight, or even in a week or more.
- rodgerd 11y ago> but millions of machines were updated. Millions more weren't. Shitty routers (did you know WEMO devices still run an old Linux 2.6 series kernel? How about Cisco firewall appliances? Yup). Home automation systems. Boxes people have half forgotten about. Systems running software from vendors who won't support you if you run anything more than half a decade old.