3 ms·

I thought Heartbleed attacks were difficult to detect. How did they determine they used the Heartbleed vulnerability, especially since the attack happened only

by mholt 12y ago

I thought Heartbleed attacks were difficult to detect. How did they determine they used the Heartbleed vulnerability, especially since the attack happened only a week after Heartbleed was revealed? > "Community Health ... disclosed yesterday that Chinese hackers stole patients’ Social Security numbers, names and addresses, without revealing how the hackers got in." And then... > “We never had any tangible proof of an attack until now,” said David Kennedy, founder of TrustedSec LLC, a security consulting company based in Cleveland, Ohio, who first reported Heartbleed was used to attack Community Health on his company’s website. Here's the report: https://www.trustedsec.com/august-2014/chs-hacked-heartbleed-exclusive-trustedsec/ https://www.trustedsec.com/august-2014/chs-hacked-heartbleed... -- but I still wonder how it was detected.

ejr 12y ago
That says they used a vulnerability in a "Juniper device"; probably a router/firewall appliance. There have been quite a few vulnerabilities[1] in their Junos line[2], but any or all of these ones seems likely[3] [1] http://www.cvedetails.com/vulnerability-list/vendor_id-874/year-2014/Juniper.html http://www.cvedetails.com/vulnerability-list/vendor_id-874/y... [2] https://en.wikipedia.org/wiki/Junos https://en.wikipedia.org/wiki/Junos [3] http://www.cvedetails.com/cve/CVE-2014-3816/ http://www.cvedetails.com/cve/CVE-2014-3816/ http://www.cvedetails.com/cve/CVE-2014-3412/ http://www.cvedetails.com/cve/CVE-2014-3412/ http://www.cvedetails.com/cve/CVE-2014-3411/ http://www.cvedetails.com/cve/CVE-2014-3411/ http://www.cvedetails.com/cve/CVE-2014-0615/ http://www.cvedetails.com/cve/CVE-2014-0615/
- warriar 12y ago
  Most probably a juniper Secure Access SSL VPN appliance. I was administrating one too when heartbleed was "made public". Luckily we were not running the latest Version Tree of the firmware so we were still on an older openssl version. I dont think Juniper Devices have more or less culnerabilities than other vendors. Its highly developed stuf (chasing technical advances, bringing new firmwares every other month). You just shouldnt use .0-1 Versions of new Release Trees like with every Vendor... And for Heartbleed: Nearly Everyone based on linux/Openssl was affected somehow.
  - ejr 12y ago
    Good point. VPN would have been an obvious target. Medical services especially need to share data with healthcare providers to ensure clients get the appropriate treatment and that usually involves secure connections between locations.

by mholt 12y ago

ejr 12y ago

That says they used a vulnerability in a "Juniper device"; probably a router/firewall appliance. There have been quite a few vulnerabilities[1] in their Junos line[2], but any or all of these ones seems likely[3] [1] http://www.cvedetails.com/vulnerability-list/vendor_id-874/year-2014/Juniper.html http://www.cvedetails.com/vulnerability-list/vendor_id-874/y... [2] https://en.wikipedia.org/wiki/Junos https://en.wikipedia.org/wiki/Junos [3] http://www.cvedetails.com/cve/CVE-2014-3816/ http://www.cvedetails.com/cve/CVE-2014-3816/ http://www.cvedetails.com/cve/CVE-2014-3412/ http://www.cvedetails.com/cve/CVE-2014-3412/ http://www.cvedetails.com/cve/CVE-2014-3411/ http://www.cvedetails.com/cve/CVE-2014-3411/ http://www.cvedetails.com/cve/CVE-2014-0615/ http://www.cvedetails.com/cve/CVE-2014-0615/

warriar 12y ago
Most probably a juniper Secure Access SSL VPN appliance. I was administrating one too when heartbleed was "made public". Luckily we were not running the latest Version Tree of the firmware so we were still on an older openssl version. I dont think Juniper Devices have more or less culnerabilities than other vendors. Its highly developed stuf (chasing technical advances, bringing new firmwares every other month). You just shouldnt use .0-1 Versions of new Release Trees like with every Vendor... And for Heartbleed: Nearly Everyone based on linux/Openssl was affected somehow.
- ejr 12y ago
  Good point. VPN would have been an obvious target. Medical services especially need to share data with healthcare providers to ensure clients get the appropriate treatment and that usually involves secure connections between locations.