3 ms·
Someone with more knowledge please correct me if this is inaccurate, but from what I have been able to understand this basically exposed 16kb of random memory e
by thefreeman 13y ago
Someone with more knowledge please correct me if this is inaccurate, but from what I have been able to understand this basically exposed 16kb of random memory each heartbeat? So the fear would be that a persistent attacker I guess could continuously run this and scan the output trying to match things like security certificates?
While I am sure this could be used on high value targets with enough resources, as a small web service outside of the tech industry I feel pretty confident that no one would invest those kind of resources to steal our SSL cert. Is that misguided?
- deleted 13y ago[deleted]
- sliverstorm 13y agoMaybe misguided, maybe not, but it's not too hard to get a new cert from your CA, especially if they revoke+reissue for free.
- sp332 13y agoYes. It doesn't take a lot of resources. It's already been noted on Twitter that someone - possibly quite a lot of people - were using HTTPS Everywhere lists to find interesting targets. Mass hacking and drive-bys are trivial. And remember, it's not just certificates! It's anything that is in your sever processes memory (the process that implemented SSL), so it could be passwords or other credentials.