#cve-2014-0160

[pir8g33k]

Heartbleed Scanner - Network Scanner for OpenSSL Memory Leak (CVE-2014-0160)

Heartbleed Scanner – Network Scanner for OpenSSL Memory Leak (CVE-2014-0160)

Heartbleed Scanner – Network Scanner for OpenSSL Memory Leak (CVE-2014-0160)

-t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r parameter to randomize the IP addresses to avoid linear scanning. -s parameter to exploit services that…

View On WordPress

[codalabs]

Recursos sobre Heartbleed

Nas últimas semanas grande parte das notícias sobre InfoSec foram sobre o Heartbleed (CVE-2014-0160), o bug no OpenSSL.

Este post é apenas um repositório de links que achei interessantes sobre o Heartbleed para referência futura. Rolou muita coisa desde a divulgação da falha, mas guardei apenas o que considerei mais relevante.

Heartbleed.com - Página original falando sobre o bug.

OpenSSL Heartbeat (Heartbleed) Vulnerability (CVE-2014-0160) and its High-Level Mechanics - Video com boa explicação sobre o funcionamento do bug.

OpenSSL TLS Heartbeat Extension Packets Handling Out-of-bounds Read Remote Memory Disclosure - Entrada no OSVDB.

#Eyebleed. A technical analysis of the fix (not the bug!) for the Heartbleed issue - Análise técnica do fix.

Extracting server private key using Heartbleed OpenSSL vulnerability - Ferramenta do indutny em node.js para extração de chaves privadas. Testada no desafio do CloudFlare

Using masscan to scan for heartbleed vulnerability

ssl-heartbleed.nse - Script para o Nmap.

Heartbleed War Room - Rapid7

Heartbleed for OpenVPN - Blog do time de pesquisa de Vulnerabilidade da Sourcefire. 

Heartbleed Impact in Belgium?

How Heartbleed transformed HTTPS security into the stuff of absurdist theater

[UPDATE] 2014-04-24: Heartbleed Impact in Belgium? e How Heartbleed transformed HTTPS security into the stuff of absurdist theater

[dyllisphiller]

Heartbleed / CVE-2014-0160

Let’s talk about something that affects you. It’s called CVE-2014-0160. You probably know it by Heartbleed. It is a security problem which affects at least 60% of the Web, including Facebook.

While sysadmins panic (which did include me for a short time), here’s what you should do:

When you receive communication from an affected Website saying that they havefixed the problem, change your password…

View On WordPress

[kernelops]

New Post has been published on Kernel | IT Security & Applications

New Post has been published on http://www.kernelops.com/heartbleed-check/

Heartbleed Check

Well, the proverbial cat’s out of the bag and everyone knows about the vulnerability called ‘Heartbleed’.

If you don’t know what Heartbleed is or what it really means to you, I’ll briefly sum it up: Heartbleed is a vulnerability found in the technology that secures websites and tons of other communication technologies.  This vulnerability allows people to snoop the memory on the web server running the website you visit.  Ideally, the interested person could see passwords, user information, session information, etc.  OpenSSL, the specific cryptographic software that is vulnerable, is used on about 2/3 of the Internet!  The news has reported that banking sites, webmail, and practically anything with an https:// at the beginning of the web address (that’s what the little padlock in front of the address means) has been vulnerable for the last 2 years.  The recommended action is to change your passwords!

So, over the past few days I’ve been asked by relatives and friends whether their banking, webmail, or a site they frequent is now secure.  To help the everyone find out about if Heartbleed still affects the sites you visit, we’ve created a simple website for everyone to use to find out.

Simply type in the web address that you’re curious about.  For instance, www.bankofamerica.com.  The site will reply and let you know the results!

It can be found here, at: http://heartbleed.kernelops.com.

Happy surfing!

[hillmediagroup]

That Heartbleed Bug, That's what caused my heart to bleed

That Heartbleed Bug, That’s what caused my heart to bleed

Insert references to “Bleeding Heart” by Jimi Hendrix. Ok, now that we have that out of the way, lets talk about the Heartbleed Bug.

Everything you consume or send online for the most part, goes through secure pathways. Researchers have discovered an extremely critical defect in the cryptographic software library an estimated two-thirds of Web servers use to identify themselves to end users and…

View On WordPress

[sourcelair]

Security: Mitigating Heartbleed vulnerability

On April 7th, 2014 the CVE-2014-0160 vulnerability of OpenSSL, commonly known as the Heartbleed bug, got announced to the public. This vulnerability allows attackers to gain access to read the memory of the host and even read private keys of the server. By now, we have no signs that sourceLair has been compromised by that kind of attack.

What we did about this

We take your security and privacy very seriously, so we took the appropriate measures, to ensure that you are safe, when you use sourceLair to do your work:

We upgraded our version of OpenSSL to the one that has the Heartbleed bug fixed.

We restarted all services that were using OpenSSL on our server.

We re-issued our SSL (HTTPS) keys and certificates.

We deleted all user sessions that started before we fixed this issue.

What you can do about this

In order to ensure even more security for yourselves, you can take several measures as well:

Reset your sourceLair password.

Revoke the GitHub access token for sourceLair and then issue a new one by logging-in with GitHub again (your sourceLair password will be needed for that)

We are constantly following updates on this issue so as to take additional measures, if needed, in order to ensure the highest level of security possible. You can follow us on Twitter, in order to stay tuned with our updates on that issue.

Till then you can go to www.sourcelair.com and continue coding on the cloud, relaxed and secure.

[crosseyedcyclops]

This is pretty important, guys: http://filippo.io/Heartbleed

[dragoni]

Me-ouchhh

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users.