4 ms·

A browser extension that warns of vulnerability would be amazing.

josh-wrale 13y ago
If someone builds this, please do not make the client actively poll the sites visited. Doing so seems likely, IMHO, to land you or even your users in jail for Computer Fraud and Abuse violations (e.g. someone visiting healthcare.gov). https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm If you do this, reference a centralized list/registry. Don't risk the reputations of your users.
- 0xdeadbeefbabe 13y ago
  The fraud is that these vulnerable sites are risking their users' private data, while pretending they are not.
  - josh-wrale 13y ago
    Security is a best effort thing. Get used to it. Make note of which providers fell short here and act accordingly. Questions?
    - 0xdeadbeefbabe 13y ago
      Imprisoning users who check for the vulnerability doesn't seem like a best effort. It also doesn't seem likely.
      - josh-wrale 13y ago
        I see you're conflating my arguments. Anyway, I'll upvote you and step aside. Edit: On second thought. Go ahead and conflate them. As I said, don't risk the reputations of your users. That goes for everyone.
  - pilom 13y ago
    Right but exploiting Heartbleed to dump memory of the target webserver is most likely "unauthorized use of a computer system" and thus in violation of the CFAA.
- rplnt 13y ago
  Can't you just check if heartbeat is enabled and poll what version of library is used? If no, could you check by setting the payload size lower than the payload? That way you know the site is vulnerable without receiving anything you shouldn't have received.
tlrobinson 13y ago
There's this, but I haven't tried it yet: https://github.com/PwnicornDev/heartbleed-test.crx https://github.com/PwnicornDev/heartbleed-test.crx
Mithrandir 13y ago
This bookmarklet works for me: javascript:void(open('http://filippo.io/Heartbleed/#'+document.location.hostname) http://filippo.io/Heartbleed/#'+document.location.hostname))
achillean 13y ago
I'm updating the Shodan Chrome plugin atm to show the data that it's collecting on heartbleed: https://chrome.google.com/webstore/detail/shodan/jjalcfnidlmpjhdfepjhjbhnhkbgleap https://chrome.google.com/webstore/detail/shodan/jjalcfnidlm...

If someone builds this, please do not make the client actively poll the sites visited. Doing so seems likely, IMHO, to land you or even your users in jail for Computer Fraud and Abuse violations (e.g. someone visiting healthcare.gov). https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm If you do this, reference a centralized list/registry. Don't risk the reputations of your users.

0xdeadbeefbabe 13y ago
The fraud is that these vulnerable sites are risking their users' private data, while pretending they are not.
- josh-wrale 13y ago
  Security is a best effort thing. Get used to it. Make note of which providers fell short here and act accordingly. Questions?
  - 0xdeadbeefbabe 13y ago
    Imprisoning users who check for the vulnerability doesn't seem like a best effort. It also doesn't seem likely.
    - josh-wrale 13y ago
      I see you're conflating my arguments. Anyway, I'll upvote you and step aside. Edit: On second thought. Go ahead and conflate them. As I said, don't risk the reputations of your users. That goes for everyone.
- pilom 13y ago
  Right but exploiting Heartbleed to dump memory of the target webserver is most likely "unauthorized use of a computer system" and thus in violation of the CFAA.
rplnt 13y ago
Can't you just check if heartbeat is enabled and poll what version of library is used? If no, could you check by setting the payload size lower than the payload? That way you know the site is vulnerable without receiving anything you shouldn't have received.

tlrobinson 13y ago

There's this, but I haven't tried it yet: https://github.com/PwnicornDev/heartbleed-test.crx https://github.com/PwnicornDev/heartbleed-test.crx

Mithrandir 13y ago

This bookmarklet works for me: javascript:void(open('http://filippo.io/Heartbleed/#'+document.location.hostname) http://filippo.io/Heartbleed/#'+document.location.hostname))

achillean 13y ago

I'm updating the Shodan Chrome plugin atm to show the data that it's collecting on heartbleed: https://chrome.google.com/webstore/detail/shodan/jjalcfnidlmpjhdfepjhjbhnhkbgleap https://chrome.google.com/webstore/detail/shodan/jjalcfnidlm...