4 ms·

Will these automated tools work on vulnerable Android devices? If so this seems a little irresponsible, I mean it is one thing to stick it to lazy sysadmins but

Will these automated tools work on vulnerable Android devices? If so this seems a little irresponsible, I mean it is one thing to stick it to lazy sysadmins but making it easy to exploit peoples phones seems evil.

Pxtl 13y ago
I'm confused how openSSL on Android is a problem... isn't openSSL a server technology? Do the clients use a heartbeat for something? Or is this only relevant when you're running a server on your client device? Is OpenSSL always running as a server on Android?
- larrysilverman 13y ago
  Android 4.1.1 is the vulnerable version. Google says only 4.1.1 is vulnerable. There are a handful of services on Android that use openssl and, I suppose, could present open ports for there to be an attack vector. See http://www.pcmag.com/article2/0,2817,2456507,00.asp http://www.pcmag.com/article2/0,2817,2456507,00.asp
  - mikeash 13y ago
    You can also MITM outgoing SSL connections and use heartbleed on them. The vulnerability is accessible before the certificate checks are completed, so the standard MITM prevention measures don't help you there.
- eli 13y ago
  Heartbeat goes both ways. If you can be tricked to accessing a malicious HTTPS server, it can extract data from the client. http://blog.meldium.com/home/2014/4/10/testing-for-reverse-heartbleed http://blog.meldium.com/home/2014/4/10/testing-for-reverse-h...
  - Pxtl 13y ago
    ... wow, the media firestorm around heartbleed was so fixated on the server-side issue that this completely slipped by me. I guess it's only relevant to one particular Android version and a handful of Linux-based versions where patching is expected to occur automatically and quickly, and nobody cares about desktop Linux.
    - eli 13y ago
      I wonder how many different ways you can trick a server into accessing a HTTPS site. Seems like lots of services check links in comments or load remote images or run webhooks... I can definitely see how a server could slip through the cracks if it has a broken HTTPS client, but the site it's serving is fine. No automated scanner is gonna pick that up from the outside.
- sp332 13y ago
  You can check for vulnerable clients using this site https://reverseheartbleed.com/ https://reverseheartbleed.com/
- lawnchair_larry 13y ago
  No, OpenSSL is equally for clients and servers. It's a general purpose crypto library. You can use it in anything to do with crypto.
makomk 13y ago
Don't think so, but some of the other tools out there probably would.

Pxtl 13y ago

I'm confused how openSSL on Android is a problem... isn't openSSL a server technology? Do the clients use a heartbeat for something? Or is this only relevant when you're running a server on your client device? Is OpenSSL always running as a server on Android?

larrysilverman 13y ago
Android 4.1.1 is the vulnerable version. Google says only 4.1.1 is vulnerable. There are a handful of services on Android that use openssl and, I suppose, could present open ports for there to be an attack vector. See http://www.pcmag.com/article2/0,2817,2456507,00.asp http://www.pcmag.com/article2/0,2817,2456507,00.asp
- mikeash 13y ago
  You can also MITM outgoing SSL connections and use heartbleed on them. The vulnerability is accessible before the certificate checks are completed, so the standard MITM prevention measures don't help you there.
eli 13y ago
Heartbeat goes both ways. If you can be tricked to accessing a malicious HTTPS server, it can extract data from the client. http://blog.meldium.com/home/2014/4/10/testing-for-reverse-heartbleed http://blog.meldium.com/home/2014/4/10/testing-for-reverse-h...
- Pxtl 13y ago
  ... wow, the media firestorm around heartbleed was so fixated on the server-side issue that this completely slipped by me. I guess it's only relevant to one particular Android version and a handful of Linux-based versions where patching is expected to occur automatically and quickly, and nobody cares about desktop Linux.
  - eli 13y ago
    I wonder how many different ways you can trick a server into accessing a HTTPS site. Seems like lots of services check links in comments or load remote images or run webhooks... I can definitely see how a server could slip through the cracks if it has a broken HTTPS client, but the site it's serving is fine. No automated scanner is gonna pick that up from the outside.
sp332 13y ago
You can check for vulnerable clients using this site https://reverseheartbleed.com/ https://reverseheartbleed.com/
lawnchair_larry 13y ago
No, OpenSSL is equally for clients and servers. It's a general purpose crypto library. You can use it in anything to do with crypto.

makomk 13y ago

Don't think so, but some of the other tools out there probably would.