david wong

Hey ! I'm David, a security consultant at Cryptography Services, the crypto team of NCC Group . This is my blog about cryptography and security and other related topics that I find interesting.

Heartbleed : serious vulnerability in open SSL April 2014

We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

A pretty bad bug has been found in open SSL during the Codenomicon. more info here: http://heartbleed.com/

List of vulnerable websites from the Alexa top 10,000 websites: https://gist.github.com/dberkholz/10169691

You can test a website here: http://filippo.io/Heartbleed/

And also, if you have a lot of time to waste, this random dude seems to know a lot about it :D

Well done! You've reached the end of my post. Now you can leave me a comment :)