3 ms·
This sort of active exploitation, showing up in different teams' logs/honeypots, might help explain the nearly-simultaneous discovery by different researchers (
by gojomo 13y ago
This sort of active exploitation, showing up in different teams' logs/honeypots, might help explain the nearly-simultaneous discovery by different researchers (Mehta at Google and others at Codenomicon) just recently.
- tlrobinson 13y agoDidn't someone say Neel Mehta found it through a code audit?
- gojomo 13y agoYes – https://news.ycombinator.com/item?id=7558015 https://news.ycombinator.com/item?id=7558015 – but not sure that wholly rules out the chance the audit of that code started because of other anomalies, which focused suspicion. Would love more detail from each of the researchers, in their own words, even if the full story is still just a mundane variant of, "we're always reading code, we just happened to be reading this code this week, it looked buggy, we confirmed danger and reported to OpenSSL".
- hackinthebochs 13y agoThis is at least somewhat reassuring to me--it means that we do have enough expertise out there being vigilant against their server logs such that attacks with serious implications can be identified in a matter of days/weeks. If people start finding evidence of exploitation in logs dating back a year, then I would really worry.