3 ms·
A malicious server can also read the memory of a client using the same heartbleed vulnerability. So the -NSA-mafia can go get the private key from a vulnerable
by willvarfar 13y ago
A malicious server can also read the memory of a client using the same heartbleed vulnerability.
So the -NSA-mafia can go get the private key from a vulnerable server, MitM its clients, and attack those clients too.
Nasty stuff. And in the last day, even those agencies that didn't know about the vulnerability beforehand have likely spidered the entire web scraping everyone's keys just-in-case.
- justincormack 13y agoAnyone seen any evidence of attempts to do this, or set up honeypots?
- kevjiang 13y agoIn fact, an attacker doesn't even need to steal the private key.. Heartbeats can be sent before certificate authentication takes place.