18 ms·
Heartbleed Alexa top 10000
- philip1209 13y agoA browser extension that warns of vulnerability would be amazing.
- josh-wrale 13y agoIf someone builds this, please do not make the client actively poll the sites visited. Doing so seems likely, IMHO, to land you or even your users in jail for Computer Fraud and Abuse violations (e.g. someone visiting healthcare.gov). https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm If you do this, reference a centralized list/registry. Don't risk the reputations of your users.
- 0xdeadbeefbabe 13y agoThe fraud is that these vulnerable sites are risking their users' private data, while pretending they are not.
- josh-wrale 13y agoSecurity is a best effort thing. Get used to it. Make note of which providers fell short here and act accordingly. Questions?
- 0xdeadbeefbabe 13y agoImprisoning users who check for the vulnerability doesn't seem like a best effort. It also doesn't seem likely.
- josh-wrale 13y agoI see you're conflating my arguments. Anyway, I'll upvote you and step aside. Edit: On second thought. Go ahead and conflate them. As I said, don't risk the reputations of your users. That goes for everyone.
- pilom 13y agoRight but exploiting Heartbleed to dump memory of the target webserver is most likely "unauthorized use of a computer system" and thus in violation of the CFAA.
- rplnt 13y agoCan't you just check if heartbeat is enabled and poll what version of library is used? If no, could you check by setting the payload size lower than the payload? That way you know the site is vulnerable without receiving anything you shouldn't have received.
- tlrobinson 13y agoThere's this, but I haven't tried it yet: https://github.com/PwnicornDev/heartbleed-test.crx https://github.com/PwnicornDev/heartbleed-test.crx
- Mithrandir 13y agoThis bookmarklet works for me: javascript:void(open('http://filippo.io/Heartbleed/#'+document.location.hostname) http://filippo.io/Heartbleed/#'+document.location.hostname))
- achillean 13y agoI'm updating the Shodan Chrome plugin atm to show the data that it's collecting on heartbleed: https://chrome.google.com/webstore/detail/shodan/jjalcfnidlmpjhdfepjhjbhnhkbgleap https://chrome.google.com/webstore/detail/shodan/jjalcfnidlm...
- tinalumfoil 13y agoNotable Sites: yahoo.com indiegogo.com metacafe.com mybet.com nascar.com okcupid.com pch.com paypal-community.com browserstack.com creditkarma.com nasa.gov twitpic.com The others are mostly porn sites, link shorteners, non-english or others people normally wouldn't have an account/put private data on. These are the sites I feel have the most significance on the list, sorry if I missed any.
- level 13y agonetflix.com is another big one
- joshfraser 13y agoNetflix has been fixed.
- jackowayed 13y agoAvast is pretty bad given that they make virus protection
- thinkling 13y agoAirbnb.com apache.org dreamhost.com ifttt.com wer ones I noticed. There are a couple of big european retailers in the list (darty, castorama).
- icodestuff 13y agoAs of earlier this morning Amazon.com was also vulnerable. OkCupid is also on this list.
- elwell 13y agoflipboard.com
- dcreemer 13y agoWe fixed it earlier today. Interesting wrinkle was that our SSL cert provider's web site was also vulnerable. We had to wait for them to update before reissuing the SSL certs.
- molf 13y agoSo only a little over 12% is still vulnerable (and possibly ~30% not using OpenSSL). And that number is still shrinking quickly. For example: Netflix, Yahoo, NASA and OKCupid have updated in the mean time.
- robododo 13y agoHow many of these have gotten new server keys? How many have invalidated all prior session ids and cookies? I have a feeling heartbleed will haunt us for a while.
- JshWright 13y agoHopefully they patch OpenSSL before they roll their keys...
- smtddr 13y agoThis will be similar to the trendnet webcam "/anony/mjpg.cgi" ordeal. To this day there are still many webcams on the internet that can be viewed by anyone and the owners of the webcam have no idea whatsoever. We're going to have fallout from this for at least the rest of this year and well into the next.
- patrickxb 13y agoSide question: Alexa still exists? People install that extension in their browser???
- mkr-hn 13y agoIt's an extension now. SEO people seem to like it for the quick look at rankings.
- Tloewald 13y agoThe question is, how much are its ratings worth based on who is using it?
- patrickxb 13y agoExactly.
- bonestamp2 13y agoWhen I look up my site on alexa, the traffic stats are pretty close to what my analytics are telling me. So, they seem to be reasonably useful, if nothing else in a relative form.
- 3rd3 13y agoWould it make sense for everyone to change their passwords because of this?
- carbocation 13y agoMany servers will still be vulnerable, so now you have 2 problems. Zawinski meme aside, perhaps it would make sense to do it on a server-by-server basis when the machines are verified patched. (Though, even then, how do you know they aren't passing information back to an Internet-exposed-but-unpatched database server?)
- regecks 13y agoIf you logged in (as in, typed your username and password) in to the site during the time the exploit has been disclosed and the site has been vulnerable, I would change your password. Otherwise, insist that the site owners invalidate all existing sessions.
- deleted 13y ago[deleted]
- RenierZA 13y agoHere you go: http://pastebin.com/Kbzr3DFv http://pastebin.com/Kbzr3DFv
- belorn 13y agoThis is the problem with a monoculture in security libraries. Back when the gnutls vulnerability came up earlier this year, some people seriously stated that we should only have one tls library and that would ensure the security of it. Find a vulnerability in a browser, and a minority subset of all users get effected. Find a issue with openssl, and key to the kingdom is there.
- rabino 13y agoNot sure I agree. More eyes in a library should mean it is more secure. I guess. Having 200 broken TSL libraries is security by obscurity. Not very useful, and a pain for sysadmins.
- bitwizzle 13y agoIt's not security by obscurity. It's security by diversity, which is arguably a good thing.
- lugg 13y agoSecurity by obscurity is also, arguably, a good thing by your logic. Seeing as someone didn't get it... Security by diversity is secure in the same way something is secure by obscurity. In other words, its not, its just harder to find the insecurity.
- rabino 13y agoIt's not harder to find the insecurity. At all. It's harder to get a generic exploit that will give you access to a lot of targets. But I'd argue that finding an exploit for a particular target would be easier.
- belorn 13y agoSecurity by diversity means that any extreme rare vulnerability will only hit a few individuals. The trade is that there will be more unique vulnerabilities found. In risk management, having risk spread out is general a favored tactic. Same is true in biology. The chance that remote memory access vulnerability is so rare, that 200 libraries (if equally used) would lower the effected number of people with a factor of almost 200.
- ArloL 13y agoEveryone should at least consider donating to the OpenSSL foundation: https://www.openssl.org/support/donations.html https://www.openssl.org/support/donations.html
- rpearl 13y agoThey write terrible, terrible code. Can I donate to some smart people looking to replace OpenSSL with something reasonable?
- newman314 13y agopopsugar.com phpnuke.org toshiba.com torcache.net ucla.edu uiuc.edu utorrent.com ifttt.com
- allochthon 13y agoI'm hoping to find a list of largish sites that were vulnerable to this bug just prior to the recent disclosure, so that I can know how to prioritize my password changing. (These forced password rotations are happening quite a lot these days.)
- jpmattia 13y agoAnyone check banks and financial institutions yet?
- voltagex_ 13y agoThe big four (?) banks in Australia seem to not be affected. I'm fairly sure they run IIS, anyway.
- ezzaf 13y agoThe largest Australian bank (commbank) was reporting as vulnerable on filippo.io/Heartbleed/ for some hours after the vulnerability became known. GE Money Australia haven't fixed their vulnerability yet either.
- voltagex_ 13y agoAh, I thought commbank was on IIS. I checked it when I posted that message and it came up green.
- hughes 13y agoMy bank (PC Financial) has been offline all evening. I wonder if it's related.
- 1_player 13y agoUK Barclays is vulnerable.
- ef47d35620c1 13y agoIt's a client problem too. Many people are over-looking that.
- iscrewyou 13y agoI've been looking everywhere for an answer but this may just be right place to ask. What can a user or a client do to protect itself? Sites can patch things up (some sooner and some later). But meanwhile, what measures should the client take while waiting for the sites to be patched up?
- regecks 13y agoAsk whoever wrote your client software to rebuild it with a new version of OpenSSL. Or, if its open source, try relink it yourself. I guess through some convoluted MITM attack, somebody could (for example) try and exploit your email client, or similar.
- elwell 13y agoIs there a quick way to test a site actively (i.e., without going and checking the openssl version)?
- sukuriant 13y agoSo, these are dumb questions; but, 1) was this list made legally? 2) is viewing the list legal?
- pilom 13y ago1.) If it was made in the US, probably not. Reading the memory of a webserver would be pretty easy for a lawyer to argue is "unauthorized use of a computer system." That is the basic definition presented in the Computer Fraud and Abuse Act. 2.) I don't know enough to be able to argue one way or another on this point. However, if you download the list or disseminate the list you are likely increasing your possible exposure.
- bpicolo 13y agoYes, it's entirely legal.
- PeterisP 13y agoThe answer to (2) is Yes regardless of what is the answer to qestion (1).
- FooBarWidget 13y agoI'm sure all the serious sites will be updated soon. But what I'm more worried about is all those routers. My home router has an admin interface that's served over SSL. I'm not so confident in that manufacturers will push out updates for those routers quickly, or that people will update them at all.
- elwell 13y agoNot sure if routers use TLS or just some utilities of OpenSSL. Could anyone confirm?
- Narkov 13y agoHome routers have bigger issues to worry about before they get to Heartbleed.
- stormbrew 13y agoThis is a mixed bag, but I'd bet your router's running an older version than 1.0.1.
- nsomething 13y agomy ASUS router uses the 1.0.0 branch so it shouldn't be vulnerable to this bug
- voltagex_ 13y agoHah, I'd be glad if my router used SSL. If anyone wants to fire up binwalk and run it over a few router firmwares, it'd make for an interesting blog post.
- maximux 13y agoI wish we could dump openssl and recompile all needed software to use polarssl
- abc123xyz 13y agoRapidshare is still vulnerable, search for "enc" session cookie, can login as any user then by editing this cookie :D it also works via their api fun fun fun
- abc123xyz 13y agoStill works... http://i.imgur.com/RLXeySY.png http://i.imgur.com/RLXeySY.png
- abc123xyz 13y agohttp://api.rapidshare.com/cgi-bin/rsapi.cgi?sub=getaccountdetails&cookie=3C2B008E27EB39EA76E1E328541B5621D5906F6083532179DC2522DD7F2299051490986E91AFE405562FC3773CB02AE1 http://api.rapidshare.com/cgi-bin/rsapi.cgi?sub=getaccountde... accountid=46048788 firstname=mandeep lastname=sihag servertime=1397038309 addtime=1359871506 username=heavenlybeast directstart=1 country=IN mailflags=n language=en jsconfig= email=heavenlybeast@live.com curfiles=36 curspace=1213591844 rapids=0 billeduntil=0 nortuntil=0 maxspacegb=10 additionalspacegb=0 maxdaytrafficmb=100 additionaldaytrafficmb=0 traffictoday=20511350 accounttype=0 valid=1 payabo=0 promocode=0 promotype=0 promovaliduntil=0 maxfilesize=300000000
- zer0defex 13y agoOne gist post and all these sites and their security drawn into question. Damn. I'm extra cynical after just reading http://goo.gl/bVDzqG http://goo.gl/bVDzqG, but damn.
- henryaj 13y agoHeh. Alexa.com is on the list.