3 ms·
Are Android or iOS affected? Android seems to ship openssl 1.0. Could a malicious server attack clients? Perhaps expose a browser's cookie jar or other saved p
by 0x0 13y ago
Are Android or iOS affected? Android seems to ship openssl 1.0.
Could a malicious server attack clients? Perhaps expose a browser's cookie jar or other saved passwords in memory?
The number of installed openssl clients across all devices and computers must be quite large.
- welder 13y agoYes, the vulnerable code is used by both client and server so any client using openssl is affected.
- biafra 13y agoWhich parts of Android really use OpenSSL to do TLS with this heartbeat feature enabled? The browsers? All Apps running on Dalvik? All apps running on ART?
- hrrsn 13y agoOpenSSL doesn't seem to be installed on my jailbroken iPhone.
- lxgr 13y agoIt seems that Android has dodged this bullet by compiling OpenSSL with NO_HEARTBEATS: https://twitter.com/agl__/status/453472368589942785 https://twitter.com/agl__/status/453472368589942785