4 ms·
Heartbleed doesn't just leak keys. It leaks random bits of memory, which can contain anything - private keys, encrypted data, unencrypted data, whatever happens
by bdonlan 12y ago
Heartbleed doesn't just leak keys. It leaks random bits of memory, which can contain anything - private keys, encrypted data, unencrypted data, whatever happens to pop out. Problem is you can repeat the attack very quickly until the data you want - say, unencrypted SINs - comes out.
- tlrobinson 12y agoI know, and I'm not sure how this is relevant to my question. I was specifically wondering if a) the heartbeat messages which leak data (keys or whatever) are encrypted or not, and b) if they are, and PFS was used, is it even possible for someone to audit a full packet capture for heartbeat attacks.