3 ms·
Heart bleed was an example of a bug hiding in plain sight that was introduced with review into the OpenSSL codebase: https://github.com/openssl/openssl/commit/
by alblue 6y ago
Heart bleed was an example of a bug hiding in plain sight that was introduced with review into the OpenSSL codebase:
https://github.com/openssl/openssl/commit/bd6941cfaa31ee8a3f8661cb98227a5cbcc0f9f3#diff-38dc72994741420e2b6c5ee074941a45 https://github.com/openssl/openssl/commit/bd6941cfaa31ee8a3f...
The author managed to get it in and it lay undiscovered for several years.
So even though this bug had the visibility and attention it wasn’t discovered in the field until several years later.
It may be that the bug was intentionally added or it may have been a simple coding mistake, but either way it’s an example of something innocuous looking being added to a project which could have been used covertly for much longer than it was publicly known about.
- SahAssar 6y agoYou make it sound like its likely or probable that heartbleed was an intentional backdoor, which is not at all proven. I don't think anyone says that open source code makes bugs impossible, but it definitely makes it harder to insert intentional backdoors.
- httpsterio 6y agoI agree, I actually know one of the guys who discovered the bug and had a talk with him the same week the CVE was released. He seemed very sure that it was simply a mistake. While fuzzing has been a thing since the 50s, it wasn't as common to fuzz stuff back when with larger input sets just due to practical issues. You'd be lucky to own a quad core CPU and nobody spent their free time throwing cycles at random Linux package source codes for fun. Stuff like this goes uncovered all the time. The Ring 0 RISC exploit from 2018 comes to mind at first. It wasn't a whole two years after Shellshock and heartbleed that Google releases their Fuzzing service.