5 ms·

>we had the bug 16 days early, no we had the bug 18 days early And we didn't know what to do about it... CIA and FBI had knowledge of variations of this vulne

by drakaal 13y ago

>we had the bug 16 days early, no we had the bug 18 days early And we didn't know what to do about it... CIA and FBI had knowledge of variations of this vulnerability nearly 10 years ago. OpenSSL has been patching variations of this bug for that whole time, and every good hacker, (and the bad ones) have been exploiting OpenSSL since its creation. https://www.openssl.org/news/secadv_20030930.txt https://www.openssl.org/news/secadv_20030930.txt People act surprised, but OpenSSL has never had a secure release. Ever.

PhasmaFelis 13y ago
> CIA and FBI had knowledge of variations of this vulnerability nearly 10 years ago. Source?
- drakaal 13y ago
  CIA and FBI servers are easy to find, and many run OpenSSL. Go see which ones have the vulnerability. You won't find it on them. Their branch doesn't have the issue. Also look through this http://web.nvd.nist.gov/view/vuln/search-results?query=openssl http://web.nvd.nist.gov/view/vuln/search-results?query=opens... You will see mentions of this bug in products that use OpenSSL quite often.
  - cdelsolar 13y ago
    haven't seen a mention of it yet.
  - PhasmaFelis 13y ago
    Do you have evidence of that being true a week ago? It's no surprise that the CIA and FBI would scramble to lock down vulnerabilities as soon as they were announced, but that's not proof that they never had them in the first place. After the Snowden business, I wouldn't be hugely surprised if the gov't was secretly aware of Heartbleed, but I'm not comfortable taking a random stranger's word for it.
    - nl 13y ago
      If the government was aware of Heartbleed,you can be sure that knowledge was buried deep in the NSA, not at your local FBI office. It is laughable to think the FBI knew about this.
- thrownaway2424 13y ago
  The bug wasn't even implemented 10 years ago.
dtech 13y ago
BS. Those bugs are completely unrelated. If there is a common denomenator between all OpenSSL bugs in the last 10 years is that they often come from basic problems/difficulties with C (array out of bounds, length checks and such).
- drakaal 13y ago
  Which is what caused those particular vulnerabilities. OpenSSL has been vulnerable as you state because it is C rather than managed code, and managing memory has never been one of the core teams strong suits. I get the reason for using C, OpenSSL is probably the most performant SSL solutions available. It is much less resource intensive than say Polar. (NSS is getting there, but is not really a solution for embedded systems [routers and such]) >all OpenSSL bugs in the last 10 years is that they often come from basic problems/difficulties with C (array out of bounds, length checks and such) When you have a means to over flow or retrieve memory you can get at data or execute code to give you data. Which is the bug that is causing heart bleed. What is making heart bleed worse is that it goes back so many versions so for the first time in a long time there is a well known vulnerability that is the same on everyone who runs it. It isn't a "worse" vulnerability it is a "more common one". Think of it like a Genetic defect. If 1 animal in 10 has it, the herd still has "herd immunity". Or the old "there are no viruses for mac" back when mac had like 2% of the market share so even when there were viruses they were hard to spread. We are now at a point everybody who wants to be malicious knows how to attack, and there are a lot of thing to attack, so more attackers will get "lucky" and find something interesting, especially since there will be so many servers that no one remember they need to track down and fix.
nl 13y ago
CIA and FBI had knowledge of variations of this vulnerability nearly 10 years ago. This isn't true. Don't make things up - this bug is bad enough without misinformation. OpenSSL has been patching variations of this bug for that whole time Untrue. OpenSSL has been patching unrelated bugs since it was created (as has most software). https://www.openssl.org/news/secadv_20030930.txt* https://www.openssl.org/news/secadv_20030930.txt* This is unrelated to heartbleed.
- drakaal 13y ago
  It is related in that there has never been a release of OpenSSL that was secure. Not one. Ever. The known vulnerabilities list for OpenSSL has never had a release that didn't have a flaw that allowed some amount of "backdooring", Dataextraction, or data manipulation. (as opposed to just a path for a DoS attack) >Don't make things up - I don't have to make things up. The CIA and FBI keep a list of known vulnerabilities, publicly and not publicly documented. They use this information for doing investigations. I have personally run in to issues where I was contacted by FBI because we had created fixes for our deployments and they contacted us to "unfix" them, because their warrants were "no knock" and they didn't wish to tell us who they were attempting to do surveillance on. Feel free to Google me (Brandon Wirtz) if you need some background on my credentials in the security space. But thanks for jumping to I make stuff up. The mis-information that is out there is that OpenSSL has ever been secure. I'm more sad nobody beyond XKCD did a good job explaining how the bug works, or doing the demonstration I like where you bash on the server and do data alignment to show a couple of gigs worth of data from a single server. People aren't scared enough of this stuff. All those people saying "change your passwords on every site", but nobody is creating a huge public list of which sites are currently not patched. so >bad enough without misinformation No. People are too complacent and the OpenSource community doesn't own up to the things they let slip by. The "smart" guys at CDN's and Banks, were never at risk because they use proxies that have extremely short "memory life" because data is streaming through rather than stored (by the time you could get a second value to do finger printing everything would have changed), and are running NSS, or Matrix or Polar. Hearbleed is an issue because too many people are too complacent, too trustworthy, and too uninformed.
  - 13y ago

by drakaal 13y ago

PhasmaFelis 13y ago

> CIA and FBI had knowledge of variations of this vulnerability nearly 10 years ago. Source?

drakaal 13y ago
CIA and FBI servers are easy to find, and many run OpenSSL. Go see which ones have the vulnerability. You won't find it on them. Their branch doesn't have the issue. Also look through this http://web.nvd.nist.gov/view/vuln/search-results?query=openssl http://web.nvd.nist.gov/view/vuln/search-results?query=opens... You will see mentions of this bug in products that use OpenSSL quite often.
- cdelsolar 13y ago
  haven't seen a mention of it yet.
- PhasmaFelis 13y ago
  Do you have evidence of that being true a week ago? It's no surprise that the CIA and FBI would scramble to lock down vulnerabilities as soon as they were announced, but that's not proof that they never had them in the first place. After the Snowden business, I wouldn't be hugely surprised if the gov't was secretly aware of Heartbleed, but I'm not comfortable taking a random stranger's word for it.
  - nl 13y ago
    If the government was aware of Heartbleed,you can be sure that knowledge was buried deep in the NSA, not at your local FBI office. It is laughable to think the FBI knew about this.
thrownaway2424 13y ago
The bug wasn't even implemented 10 years ago.

dtech 13y ago

BS. Those bugs are completely unrelated. If there is a common denomenator between all OpenSSL bugs in the last 10 years is that they often come from basic problems/difficulties with C (array out of bounds, length checks and such).

drakaal 13y ago
Which is what caused those particular vulnerabilities. OpenSSL has been vulnerable as you state because it is C rather than managed code, and managing memory has never been one of the core teams strong suits. I get the reason for using C, OpenSSL is probably the most performant SSL solutions available. It is much less resource intensive than say Polar. (NSS is getting there, but is not really a solution for embedded systems [routers and such]) >all OpenSSL bugs in the last 10 years is that they often come from basic problems/difficulties with C (array out of bounds, length checks and such) When you have a means to over flow or retrieve memory you can get at data or execute code to give you data. Which is the bug that is causing heart bleed. What is making heart bleed worse is that it goes back so many versions so for the first time in a long time there is a well known vulnerability that is the same on everyone who runs it. It isn't a "worse" vulnerability it is a "more common one". Think of it like a Genetic defect. If 1 animal in 10 has it, the herd still has "herd immunity". Or the old "there are no viruses for mac" back when mac had like 2% of the market share so even when there were viruses they were hard to spread. We are now at a point everybody who wants to be malicious knows how to attack, and there are a lot of thing to attack, so more attackers will get "lucky" and find something interesting, especially since there will be so many servers that no one remember they need to track down and fix.

nl 13y ago

CIA and FBI had knowledge of variations of this vulnerability nearly 10 years ago. This isn't true. Don't make things up - this bug is bad enough without misinformation. OpenSSL has been patching variations of this bug for that whole time Untrue. OpenSSL has been patching unrelated bugs since it was created (as has most software). https://www.openssl.org/news/secadv_20030930.txt* https://www.openssl.org/news/secadv_20030930.txt* This is unrelated to heartbleed.

drakaal 13y ago
It is related in that there has never been a release of OpenSSL that was secure. Not one. Ever. The known vulnerabilities list for OpenSSL has never had a release that didn't have a flaw that allowed some amount of "backdooring", Dataextraction, or data manipulation. (as opposed to just a path for a DoS attack) >Don't make things up - I don't have to make things up. The CIA and FBI keep a list of known vulnerabilities, publicly and not publicly documented. They use this information for doing investigations. I have personally run in to issues where I was contacted by FBI because we had created fixes for our deployments and they contacted us to "unfix" them, because their warrants were "no knock" and they didn't wish to tell us who they were attempting to do surveillance on. Feel free to Google me (Brandon Wirtz) if you need some background on my credentials in the security space. But thanks for jumping to I make stuff up. The mis-information that is out there is that OpenSSL has ever been secure. I'm more sad nobody beyond XKCD did a good job explaining how the bug works, or doing the demonstration I like where you bash on the server and do data alignment to show a couple of gigs worth of data from a single server. People aren't scared enough of this stuff. All those people saying "change your passwords on every site", but nobody is creating a huge public list of which sites are currently not patched. so >bad enough without misinformation No. People are too complacent and the OpenSource community doesn't own up to the things they let slip by. The "smart" guys at CDN's and Banks, were never at risk because they use proxies that have extremely short "memory life" because data is streaming through rather than stored (by the time you could get a second value to do finger printing everything would have changed), and are running NSS, or Matrix or Polar. Hearbleed is an issue because too many people are too complacent, too trustworthy, and too uninformed.
- 13y ago