More OpenSSL and certificate things (in the aftermath of Heartbleed)
Posted by jpluimers on 2014/04/13
So you think Heartbleed is over. Think again. Not only servers are affected. Clients too. And you need to tighten your security even more.
Basically it comes down to this:
Expect all sites using HTTPS to have been vulnerable, and all data you exchanged to be captured. Unless you can have hard proof they were not vulnerable, or the traffic was not captured. If you have not started changing passwords, private keys, credit card numbers, etc: do so now.
and
In layman’s terms/pictures: xkcd: Heartbleed Explanation.
If you still don’t get it: anyone with any HTTPS connection to a once vulnerable system could copy data out of that system. There is no guarantee that data did not contain your identity (username, password, public key, credit card check-digits, etc) or server identity (private and public key).
Since often you cannot prove a system was using OpenSSL, there is no way to prove your data didn’t get copied.
Here are some interesting reads from last week:
- This might be a good time to check this box in your Chrome Browser under settings: “Check for certificate revocation” (Kenton Varda – Google+).
- Von Passworten, Schlüsseln und Hashes (Kristian Köhntopp – Google+).
- Here’s what you need to know to protect yourself from the major encryption flaw #heartbleed (Mashable – Google+).
- Android 4.1.1 Devices are Vulnerable to Heartbleed « The Wiert Corner – irregular stream of stuff.
- Impact-Bewertung von Heartbleed (Johann-Peter Hartmann – Google+).
- Ready for round two? #reverse #heartbleed (Sebastian Mauer – Google+).
- xkcd: Heartbleed Explanation, or why you should reset passwords, certificates and request new credit cards. « The Wiert Corner – irregular stream of stuff.
- Robert Scoble – Google+ – Changing passwords is a pain in the behind. But everyone should be doing this because of the Heartbleed problems.
- The heartbleed bug explained in (relatively) understandable English (Martijn Coppoolse – Google+).
- Das Internet ist kaputt – Erste Spuren deuten also darauf hin, dass NSA & Co. den Bug schon länger kannten und so in verschlüsselte Verbindungen eindringen konnten (Norbert Rittel – Google+).
- Heartbleed Headsup im IRC: A> Ich hör hier aus den Nachbarzimmern, daß vieleLeute inzwischen diverse Gigabyte großeDatensammlungen von heartbleed-Dumps angelegt haben. (Kristian Köhntopp – Google+).
–jeroen
The Wiert Corner - irregular stream of stuff 
On resetting passwords because of the OpenSSL vulnerability « The Wiert Corner – irregular stream of stuff said
[…] More OpenSSL and cer… on xkcd: Heartbleed Explanation,… […]