next »

[Please Support Us!]

Please Support Us!

Please help keep (=WDG=) alive

• Server rules
• Forum rules
• Join us
  
• Clan members
• About the clan
• Server stats
• WDG YouTube Channel
• WDG Downloads
• IRC Webchat

Steam groups:

• WDG community
• WDG clan group
• WDG Battlelog Platoon

Our allies:

• [NuB] TF2 clan
• Velocity Gamers Hub
• Destination Gamer

GoG Links:

• Wix Discord
• Wix IRC channel

TF2 Links:

• Official TF2 Blog
• TF2 Steam Forum
• The Fort 2

April 2024

Mo	Tu	We	Th	Fr	Sa	Su
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30
	Birthdays
Cheez (34), Sk1nn3d (40)
	Upcoming Events
Upcoming Birthdays: Cheez (34), Sk1nn3d (40)

[discordance]

For your safety and amusement, boys and girls the big one is here. The mother of all security bugs.

http://arstechnica.com/security/2014/04/critical-crypto-bug-in-openssl-opens-two-thirds-of-the-web-to-eavesdropping/
http://arstechnica.com/security/2014/04/critical-crypto-bug-exposes-yahoo-mail-passwords-russian-roulette-style/

66% of websites and servers are affected, they each put 64kb of active memory out over their "secure" SSL connections (The 64kb is a different area of memory each time a message is sent). Passwords, certificates, encrypted data, everything must go!

[discordance]

You need to change passwords on any service affected, but only after they have applied the patch and revoked their old certificates.
The following relevant sites so far are confirmed compromised.

Amazon hosting
minecraft
Flickr, Archive.org, Yahoo.com (and Yahoo Mail), Imgur, OKCupid, XDA-Developers, Steam (SteamCommunity.com), Eventbrite, 500px, and Slate

Steam haven't issued a statement yet which is extremely worrying considering they have been confirmed and reported as affected.

https://github.com/musalbas/heartbleed-masstest/blob/master/top1000.txt

[Berath]

So they need to tell us when they've applied the patch then.

[discordance]

applying the patch is useless without revoking your certificates as well, they have to do both. But yes this is the worrying thing. They've said nothing yet despite being reported as vulnerable on many tech news sites.

[r007]

My guess is they'll just silently switch the keys. At least that's what I'll do once I get around to it.

At any rate, if someone (*cough*NSA*cough*) was actively using this before it became publically known, they're facing a huge needle and haystack problem.

[discordance]

Reports have come in of attacks dating back to at least last november. Fuck.

Silently changing your certs is extremely inappropiate in this case as all users need to change passwords after. Its a sign of total incompetance and no commitment to security to leave your users high and dry in this (talking bout valve but if you have users you need to tell them too r007 or at least just force a password reset). Perhaps they are being slow still but they are running out of time for handling this.

[CruelCow]

a huge needle and haystack problem.

Not really. People were able to extract private keys within hours after they heard about the bug. A state level attacker (who had potentially 2 years!) should've been able to do that on a wide scale easily.

Reports have come in of attacks dating back to at least last november.

Link? Openssl doesn't log heartbeats, so it shouldn't be detectable retroactively.

[discordance]

Cant link from here. The suspect packet packet is loggable though on extreme logging settings. Security researchers had a few servers that have such packets in their logs from last november. The packet itself has a 0 length payload but a header declaring a 64kb length. This is what has been identified in some logs.

OpenSSL trusts the declared length of the packet and allocates that much memory then copies in the received payload. If the payload isnt actually the right length you get uninitialised memory. This isnt just a bounds check fail. This is the guy who wrote and then implemented the spec on heartbeat and trusted an external packet to declare a valid length. So dumb.

EDIT in round 2 dumbness they specifically disabled security features of malloc to prevent buffer overflow. Dumb dumb dumb dumb etc.

Only took 3 whole days but its finally the featured story on the guardian this afternoon. Perhaps because according to the bbc facebook and google were also affected and have been fixed and they need password changes now.

[discordance]

In case my last post buries it. Google and facebook are reported by the bbc as affected and you now need to reset your passwords

[Banrab]

What sucks is I have so many passwords for so many sites and now I'm gonna have to change them all .


Is it really that bad or could I risk not changing them (every site has a slightly diff password)

[discordance]

Its really that bad. The attack has been known for a minimum of 5 months and has been around for 2 years. All passwords affected by this have to be assumed compromised. Get a password manager like keepass or lastpass it will help you get a grip on this mess and have stronger passwords.

EDIT: and bear in mind that the NSA were/are recording all encrypted communications... They might not be responsible for this but its a given they knew about it and recorded as much as they could. So they have server certs and passwords for basically everyone everywhere...

[discordance]

Oh good routers now.
http://arstechnica.com/security/2014/04/cisco-finds-13-products-so-far-vulnerable-to-heartbleed-including-phones/

[Hulinut]

In case anyone didn't get disco's explanation of how the bug worked, xkcd has a nice one: http://xkcd.com/1354/

[Brahms]

http://blog.cloudflare.com/answering-the-critical-question-can-you-get-private-ssl-keys-using-heartbleed

[discordance]

http://arstechnica.com/security/2014/04/nsa-used-heartbleed-nearly-from-the-start-report-claims/

I was ignoring the cries of conspiracy at first. But hmmmmm. To be fair they probably have the people to do the software verification than OpenSSL couldn't be bothered to do. But still, right from the start? Getting a bit suspicious.