6 ms·
This thing has been in the wild for two years. What are the odds it hasn't been systematically abused? And what does this imply? To me it sounds kind of like f
by oskarth 13y ago
This thing has been in the wild for two years. What are the odds it hasn't been systematically abused? And what does this imply?
To me it sounds kind of like finding out the fence in your backyard was cut open two years ago. Except in this case the backyard is two thirds of the internet.
- ams6110 13y agoWorse, it's retroactively unfixable: Even doing all this [revoking certs, new secret keys, new certificates] will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. So it would be a good idea to change all your passwords to critical services like email and banks, once they have issued new certs and updated their openssl.
- this_user 13y agoShouldn't Perfect Forward Secrecy protect against exactly this kind of scenario where the server's primary keys are compromised?
- makomk 13y agoIt does, assuming you don't have any way to extract the session keys from server RAM - which is kind of the problem here.
- this_user 13y agoI was thinking of the scenario of old traffic being recorded by someone. Unless they also extracted the session key at that time, that traffic should be secure if PFC was enabled even if someone where to extract the server key now.
- ivanr 13y agoYes, but there are other ways to compromise TLS sessions. For example, if you're using session tickets, the ticket key could be in RAM. Or, the session master keys themselves could be leaked. Still, you're _much_ better off with Forward Secrecy -- in most cases keys ticket keys are rotated with server restarts; so are session master keys.
- orblivion 13y agoNot again. GAH. I just did this after GnutlsGate.
- gcv 13y agoHow do you suggest going about finding out if a bank updated the OpenSSL version in its DMZ?
- lockes5hadow 13y agoMy plan is to wait until the cert changes. If they don't change the cert then there is no point in updating my password anyway.
- nhaehnle 13y agoWorse, it's retroactively unfixable That's slightly misleading. Every private key disclosure leads to decryption of past traffic unless forward secrecy is used. However, if you switch to a fixed version of OpenSSL now, then an attacker cannot retroactively exploit this bug even if they have recorded all your past traffic, because exploiting the bug requires a live connection. (Of course, this only applies to attackers who did not know about the bug before it was publicly released, so some worry is still justified. I only wanted to point out that the "retroactively unfixable" is a misleading exaggeration.)
- vesinisa 13y agoI think what was meant is that since exploiting this bug leaves no trace, you should automatically consider every master key ever loaded to a vulnerable OpenSSL application to be already compromised. As nothing says this is the first discovery of the bug, one should consider that the black hats have already been exploiting this for long before the first public disclosure.
- userbinator 13y ago> And what does this imply? To me, this implies that it's not too easy to exploit, or we would've seen it fixed much sooner.
- colinbartlett 13y agoIt's extremely easy to exploit once it is known. The question is simply: Did people know about it and not disclose so they could keep exploiting it?