12 ms·
OpenSSL.org hacked?
- HCIdivision17 13y agoFor when the page is fixed, it currently says: TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _
- hobs 13y agoYeah I dont see it at this point, so fairly fast turnaround.
- grogenaut 13y agoI've wondered this for quite a while but why isn't there a standard for browsers like <a href="bigassfile" checksumhref="checksumhrefforbigassfile" checksumalgo="shashamd19">Download with check</a> I mean no one ever checks them anyways so it's not like they're useful. The second step would to be to provide a reputable repo of software version -> checksum lookups so I didn't have to trust a given server for that. This is me thinking and drinking and I'd love comments.
- erichurkman 13y agoYou run right back into if you don't already trust the signer of the checksum, you can't trust the checksum, either. The next logical step is some kind of third party authority, and then you right right into the Certificate Authority problem set, including code signing licenses like Apple and Windows use. Some F/OSS systems are starting to use similar systems, like the newer Python package distribution systems.
- grogenaut 13y agoYes I agree. See my more fully fleshed out statement parallel. But checksums are currently pointless from a secuirty standpoint.
- grogenaut 13y agoPlease see https://news.ycombinator.com/item?id=6978605 https://news.ycombinator.com/item?id=6978605 as my box was moving incredibly slowly when I wrote this. Laptops are not meant for data mining.
- alexmuller 13y agoContent-Security-Policy is doing something vaguely similar with <script> tags, where you add a nonce in the HTTP header and then only <script nonce='foo'> tags with those nonces are executed. script-src at http://www.w3.org/TR/CSP11/ http://www.w3.org/TR/CSP11/
- khc 13y ago1) hack high profile website 2) wait for it to be posted on hackernews 3) restore the page to appear normal, but embed a browser exploit 4) ... 5) profit!
- srl 13y agoOther pages are still up (although I haven't checked that they're unmodified) - it does appear the attacker didn't bother to bring anything but the front page down.
- zaroth 13y agoI tend not to click on links advertising pages that are hacked. You know, not that many zero days on Chrome, but still seems like a risky click, as they say.
- deleted 13y ago[deleted]
- sillysaurus2 13y ago$ curl www.openssl.org TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _
- devdoomari 13y agobut what if they set-up the server side so that the server returns different results depending on the browser/OS?
- dangrossman 13y ago$ curl -A "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36" www.openssl.org
- Aaronn 13y agoPosted on Twitter an hour ago: https://twitter.com/Turkguvenligi/status/417099879463129089 https://twitter.com/Turkguvenligi/status/417099879463129089 "openssl.org/ owned ;) http://zone-h.org/mirror/id/21425720 http://zone-h.org/mirror/id/21425720 …"
- jscheel 13y agoTheir security certificate still appears valid.
- rhgraysonii 13y agoForgive me for the ignorance but why is this significant if at all? Honestly curious, not being facetious.
- 0x0 13y agoIf they can replace the front page html, they could probably also replace the source code distribution with a backdoored/trojaned tarball. Or someone else might already have done so, since who knows how long ago, using the same exploit.
- userbinator 13y agoBut would they also be able to replace the public key of the authors in all the other places it appears on the Internet?
- dionyziz 13y agoThat. That's why the authors PGP-sign their sources. Furthermore, some of us maintain GPG trust paths, so replacing it on every other place on the Internet would still be futile.
- dmix 13y agoThere is also benefits of using decentralized distribution channels like bittorrent. So a single source can't be compromised.
- gcr 13y agoThis shows that website security depends on far more than just deploying over SSL.
- yeukhon 13y agoWho runs OpenSSL? Is it again volunteer? I think big companies need to step in and help creating infrastructure for these big projects.
- deleted 13y ago[deleted]
- almosnow 13y agoIs this the site that offered you free SSL certs?
- borplk 13y agoNo
- almosnow 13y agoOh sorry, 'apt-get' has spoiled me (somehow I've never knew what was the official home of openssl). Not cool at all, and apparently the guys running the site haven't took notice yet.
- virtualSatai 13y agohttp://www.startssl.com/ http://www.startssl.com/ does that.
- kenrick 13y agoWho is in the favicon?
- dangrossman 13y agoNobody; it's the text "OpenSSL" squished into 16x16.
- kenrick 13y agook
- almosnow 13y agoIt just says OpenSSL
- wzy 13y agothey're back...
- rhgraysonii 13y agoForgive me for the ignorance but why is this significant if at all? Honestly curious, not being facetious.
- midas007 13y agoYet another example of why to both sign release artifacts AND verify them is important. Also, if you're running the public website for a security lib or core FOSS package, expect more attacks by kiddies trying to build rep... so very conservative tech choices (mostly static website served from a read-only fs) and defensive practices are de rigueur.
- peterwwillis 13y agoWhat's the use in a static website or a read-only FS when you can overwrite what's in RAM, or just attack routing or DNS? Security is a little more complex.
- markdown 13y agoAhh yes, the "if you can't turn it into Fort Knox, don't bother at all" guy. Turning up at every security discussion since 1874.
- bdamm 13y agoYou can't claim that serving static content from a read-only filesystem is "de rigueur", and that securing your DNS registration is "fort knox". I think the point was that the OP was claiming static content from a read-only filesystem as the solution, and the reply was pointing out that this is hardly the best or first actions. I would personally expect that the openssl group is suffering some embarrassment, but this sort of hack is a risk of the business. Hopefully we get a good writeup.
- verroq 13y agoThe point is that when your attacker has the skill to overwrite your web server's memory to carry out an attack. You never had a chance.
- orclev 13y agoThe point is to minimize attack surfaces. If you're serving static content that's one less path for an attacker to potentially exploit. With only static files exploits are limited to those contained in the web server or the OS network code. With a read only filesystem certain classes of privilege escalation are eliminated. Attacks on routing or DNS are more difficult to deal with, but at least it isn't your server being compromised, and if you're using HTTPS properly then the certificate should show as invalid at least. So yeah, security is complex, but his advice was spot on. The fact that you seem to call it into question says that you don't know much about security.
- gtklocker 13y agoWhat is a good reason for openssl.org not to utilize HSTS[1]? $ curl -I https://www.openssl.org/ HTTP/1.1 200 OK Date: Sun, 29 Dec 2013 03:57:54 GMT Server: Apache/2.2.22 (Ubuntu) Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 15686 Content-Type: text/html [1]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
- peterwwillis 13y agoBecause it doesn't need it. Technically no website needs it. Only people who don't know how to type "https" need it.
- netik 13y agoNo. HSTS prevents SSLStrip attacks when the intended destination is always meant to be in SSL.
- peterwwillis 13y agoSSLStrip does not work on valid HTTPS requests. If you request an HTTPS page, it can not be subverted into HTTP. If it could, HTTPS would be pointless. So, yes, HSTS is not required for a valid HTTPS request. This is not some semantic argument, or some sort of side channel attack crap. HSTS is not necessary for HTTPS requests, period.
- thirsteh 13y agoIt's necessary for HTTP requests. Are you being deliberately obtuse?
- ars_technician 13y agoIt doesn't work if the user hasn't visited the site before because the HSTS header can be stripped just as easily.
- davvid 13y agoDoes anyone have any details about how this was done? Was it a compromised admin account, a local root exploit, social engineering, etc? I'm eagerly awaiting the post-mortem.
- lucb1e 13y agoNo, and this is what makes it non-news. Especially since it links to the hacked webpage. Neither really Hacker nor News...
- mackwic 13y agoHopefully, hacker has a meaning far more open than "security guys" or "security guys that know how to break things". Sorry to prefer build things and creating value than destroy it. I wonder why so many security guys are so condescending and contemptuous...
- grogenaut 13y agoI said this in a lower thread but I figured it's better up here. Why is there not a standard for links of this type in browsers. Eg <a href="url" sigurl="url to sig" sigalgo="algo to calculate signature">OpenSSL</a> That's a simple way to go but I really think it's as generally insecure as reading a signature form a url that is advertised by a website. It's also why I rarely bother. But if browsers were good about this then it could be done in a much better way which is to sign the application with a real peer verifiable signing method. Such as the SSL cert that covers the site behind the open source project . now this only works for projects that have SSL certs. Another method would be to have a clearing house that can do 1-1 with github et al and a re cert, like a oss cert organization. A final good way would be to use the beauty of git and use the source checksums and a repeatable build process (which is fricking hard) and come up with a way to give a signature for oss applications based on a git commit and check that back to the public git repository. really I think knwon public keys for oss projects and branches would be the real answer. And the security gating for newbs would be like windows and linux which check the public signature of the application before they run them from the web and make the end user feel safe instead of doing nothing. Browsers have a good share in this responsibility as well. Standard domain security should work well here as well. Better than what we have. I leave this to more entreprenurial minds to make this work and I'd love some real telegraph style sinkers to point out the flaws. This is must me talking after a belated xmas dinner. but I think I'm kind of on course.
- jessaustin 13y agoYeah the public key used for signing has to be communicated via a different channel, otherwise we're spinning our wheels. I think DNSSEC is headed in the right direction, but hasn't arrived yet. But that's if we're talking websites in general. For the specific use here, installing "trusted" software packages, far better solutions already exist and already protected the users of OpenSSL.
- s3yfullah 13y agoZone-H Mirror > http://www.zone-h.org/mirror/id/21425720 http://www.zone-h.org/mirror/id/21425720
- louwrentius 13y agoThe fact that the OpenSSL maintainers haven't communicated about this issue yet make me feel very uncomfortable.
- ams6110 13y agoCurrently posted: 29-Dec-2013: Web site defacement. Investigation in progress, more details to follow.