Cloudflare's engineers have set up a server vulnerable to Heartbleed, if you find the secret SSL keys and publish your solution you'll get 10,000$. The challenge is here and there's a blog post here.
an attacker can get up to 64kB of the server’s working memory. This is the result of a classic implementation bug known as a Buffer over-read
Apparently it is not known if it is possible or not to find those keys. If it appears to be possible the results would be catastrophic as every single website that has used OpenSSL would have to revoke and ask for a new certificate. And as Cloudflare says:
the certificate revocation process is far from perfect and was never built for revocation at mass scale.
So it would then be very easy for any server to pretend they're someone else.
A heartbeat is a message that is sent to the server just so the server can send it back. This lets a client know that the server is still connected and listening. The heartbleed bug was a mistake in the implementation of the response to a heartbeat message.
This is the code in question:
p = &s->s3->rrec.data[0]
[...]
hbtype = *p++;
n2s(p, payload);
pl = p;
[...]
buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;
[...]
memcpy(bp, pl, payload);
The team at Detectify found a way to access files on one of google's production server. Thanks to an old google product (google toolbar) that was using a poorly secured XML parser.
They just used a simple XXE attack where they uploaded a poisoned xml files and saw what the application printed back
a xxe looks like this:
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
More on their blog
I found a pretty nice explanation of Heartbleed for the layman in this XKCD comic. Heartbleed is a recent and alarming vulnerability found in the OpenSSL toolkit that serves most of the application/websites today. To quote Schneier:
"Catastrophic" is the right word. On the scale of 1 to 10, this is an 11.
Here's the comic:
And if you want to dig a bit more into it, you can read some more explanations on security.stackexchange.
..We're proud to welcome Dr. Condoleezza Rice to our Board of Directors. When looking to grow our board, we sought out a leader who could help us expand our global footprint. Dr. Rice has had an illustrious career as Provost of Stanford University, board member of companies like Hewlett Packard and Charles Schwab, and former United States Secretary of State. We’re honored to be adding someone as brilliant and accomplished as Dr. Rice to our team.
People are not happy with that news.
When I knew you at Stanford I had the greatest admiration for your abilities and good sense. But now I cannot help but express to you my chagrin that the warm feelings I once had have basically evaporated. I hope you can pause to try to understand why this might be the case.
Don Knuth's open letter to Condoleezza Rice
A message some users of Virwox received:
Hello,
here is what has happened:
Similar to other exchanges, our servers are protected from DDOS-attacks by an external service provider. While our own servers themselves were not vulnerable to the "Heartbleed" attack, the proxy servers of the DDOS provider were. They have fixed the problem already and we have turned on the service again.
The good news is that our own server was NOT hacked, and none of our secrets or bitcoins were stolen. However, the attacker was able to get to the session cookies of in total 20 users who were logged in yesterday (between about 8am and 11am), and used this to try to withdraw the money they had in their account in the form of bitcoins.
They don't say how much loss they have suffered, but they have reimbursed the victims.
My blog
posted April 2014
I wanted to learn Python, so a few months ago (I forgot to post about it here!) I redid my old blog in Django.
It's way different than PHP but it was a lot of fun :) I love learning different technologies. You can check it out here but be careful, it's in french!
Here's a list of what I want to learn right now:
- QT with C++
- Unity
- Android applications
Brackets
posted April 2014
I recently advised a colleague to try Brackets since he's learning html, css, etc...
But I've never really used it myself for a project. I've tried it, found it really cool, but never had a chance to start a project with it yet.
As I was trying to convince my colleague to give it a try I ran into this cool video from Jeffrey Way the guy who made Tutsplus (and the amazing sublime text tutorial)
Check it out!
There's a few reasons for this. First, the Tarsnap client-server protocol does not use TLS
I was also lucky: The Tarsnap webserver happens to be running an older version of OpenSSL which never had the vulnerable code
http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html
For those who are curious about the protocol that Tarsnap uses : it's explained here
