6 ms·
Heartbeat goes both ways. If you can be tricked to accessing a malicious HTTPS server, it can extract data from the client. http://blog.meldium.com/home/2014/4/
by eli 13y ago
Heartbeat goes both ways. If you can be tricked to accessing a malicious HTTPS server, it can extract data from the client. http://blog.meldium.com/home/2014/4/10/testing-for-reverse-heartbleed http://blog.meldium.com/home/2014/4/10/testing-for-reverse-h...
- Pxtl 13y ago... wow, the media firestorm around heartbleed was so fixated on the server-side issue that this completely slipped by me. I guess it's only relevant to one particular Android version and a handful of Linux-based versions where patching is expected to occur automatically and quickly, and nobody cares about desktop Linux.
- eli 13y agoI wonder how many different ways you can trick a server into accessing a HTTPS site. Seems like lots of services check links in comments or load remote images or run webhooks... I can definitely see how a server could slip through the cracks if it has a broken HTTPS client, but the site it's serving is fine. No automated scanner is gonna pick that up from the outside.