The Internet continues to recover from the body blow delivered by OpenSSL's "heartbleed" flaw. Organizations scramble
to re-key certificates, CAs fill up CRL lists at exponential rates, while end-users change critical passwords.

CloudFlare's "steal our SSL keys" challenge played a pivotal role in how heartbleed is getting managed. Crowd-sourcing the
investigation of whether private keys were vulnerable or not turned out to be an inspired decision. Thanks to them, the
answer arrived quickly and violently: yes they are!

Suddenly we knew we weren't in the land of "what if"s - the threat was very serious and very real.

CloudFlare's written a nice summary which I recommend. In addition to providing useful information regarding heartbleed,
private keys, and RSA, it lists their challenge winners.

As it turns out, the hall-of-fame includes a slacker. Lucky 13!

--mancha

Congratz on your work.

http://blog.cloudflare.com/the-heart...d-and-reissued

This might be an answer:
http://article.gmane.org/gmane.os.openbsd.misc/211963

1 members found this post helpful.

Nice to see your name there. Well done!

And a big thanks for all your efforts in trying to keep your fellow Slackers secure.

1 members found this post helpful.

... Big thanks as well from another Slacker.

1 members found this post helpful.

Thanks for the recap, and nice work!

Meanwhile in OpenBSD land: http://opensslrampage.org/

1 members found this post helpful.

I do wonder why openssl devs insist on implementing their own versions of standard library functions, and doing a horrible job of it while they are at it. It might be because of performance, but isn't openssl supposed to be about security ? Maybe not.

I'm starting to get more worried about now who these people are and if there's a reason behind this serious security flaw since all that crap about the NSA and Edward Snowden went public and viral. NSA leaked info said that the NSA had slipped people into development teams, bribed, conned, or forced projects and operating systems closed source and open source to have security flaws that the NSA could exploit.

I don't intent to start any conspiracy thought and theories but these are serious security flaws that have compromised an extremely high level of internet websites and databases to have been caused by something so trivial on the level as a decimal point off by one digit if that's a near-accurate comparison.

If HeartBleed has been around this long as a bug, there's no telling how long our information both public and private has been leaking and bleeding out and even worse, who has known about it all this time, and never breathed so much as a sigh about it, and was tapping into our lives in the dark unnoticed.

Even worse, I wonder how many other unknown security flaws still exist in other projects that are nearly on the same level of critical as HeartBleed that are out there possibly being exploited in the dark. I'm not saying we need to start blaming people directly, start background checking developers, or force code audits on a massive scale, but we should start being more cautious.

2 members found this post helpful.

I am less knowledgeable about security then most but wouldn't most of these exploits be protected if most people used multiple layers of security such as Hardware and software firewalls, SSL certs + passwords, and simply changing the default ports these "security flawed" services run on ? I have also come to reliazed there is no such thing as Secure once a system is connected to the internet.

This is a little Of topic but
RE:ReaperX7


If people really thought there data wasn't being spied on by the governments of the world, I have to say most people are oblivious. I actually want my government to be spying on us, It helps keep us safe, we do have laws that make the information they gather worthless in court. Also I look at it this way.... If I don't do anything Bad then they wont bother with me anyway. Who cares if they have those "naked Photos" from that crazy weekend (warning it can make them go blind) and those love letters i wrote to an EX. Its their waste of time not mine Being spied on is nothing new just something we have to expect, and for those Facebook,Twitter,Myspace ect ect users just keep making their job easier they know with you and your friends associate with and what your "behaviour profile" is without even interviewing you. And for advice to anyone doing something illegal Dont use anything that is electric, Sound proof your rooms, and trust noone , or just stop it


my

I was gonna ask if there is an alternative to openssl, but looking around there probably isn't. I don't know how many programs will build with GNUTLS instead of openssl, and there are many to rebuild.

Had to do the Quick google search for alts to Openssl... Found this one

http://www.yassl.com/yaSSL/Home.html

Looks interesting

***** Not Truly open

There is Mozilla libnss, which has its own API of course and isn't a drop-in replacement for OpenSSL.

I'm surprised GNUTLS isn't as widely used.

This is one guys opion about it

I did see that one before, actually the cyassl has an openssl compatibility layer, but is NOT a drop-in replacement and I don't know which programs can be built against it.

I guess it is sad to see that both openssl and gnutls have major internal coding issues. Maybe someone should start a kickstarter program to audit the code like truecrypt recently did. These are the very foundation of security for Linux, so it would definitely be worth it.