A warning from SANS to end users against Heartbleed

The risk of Heartbleed client-side attacks and recommendations for end users is focused at the fourth briefing on the bug from the SANS Institute's Internet Storm Centre (ISC).

SANS is the most trusted and by far the largest source for information security training and security certification in the world. A range of individuals from auditors and network administrators, to chief information security officers are sharing the lessons they learn and are jointly finding solutions to the challenges they face. At the heart of SANS are the many security practitioners in varied global organizations from corporations to universities working together to help the entire information security community.

"A lot of the effort initially has been on servers, and servers are certainly at the most risk — not just web servers, but mail servers, and all of that good stuff as well. Everything that uses OpenSSL with an affected version is vulnerable, whether it's a client, whether it's a server — and of course as an end user, you're mostly concerned about the client part," said SANS presenter and ISC chief technology officer Johannes Ullrich.

Clients are indeed vulnerable, said Ullrich, but not the most popular ones. At the operating system level, Apple's OS X uses OpenSSL version 0.9.8, not the Heartbleed-vulnerable version 1.0.1, and Windows doesn't use OpenSSL at all — although there can be a risk from Windows application that have been statically compiled against OpenSSL libraries.

"It's unlikely that a normal, average home windows user has OpenSSL on their system," Ullrich said. "You're not going to run a web server on your home Windows machine." And Android devices are the main client-side risk, because it's the only major operating system that uses OpenSSL widely.

"The first message [for home and family users] is 'Do not patch.' This sounds counter-intuitive, and yes there may be software that people have installed that does use OpenSSL," he said. But for home users who've seen Heartbleed scare stories in the mainstream media, being caught by scams is the greater risk.

The second message is that, yes, changing passwords to online services is "probably a good idea", Ullrich said. "Even if if didn't get leaked, it's probably not going to break anything." And, because changing so many passwords is a pain, get a password manager.
"If you still have to remember all your passwords, and if you are able to do so, your passwords are too weak," he said.

Continue reading →

Call of Duty is not secure from Heartbleed

Heartbleed took Call of Duty: Black Ops II‘s blood out too, according to security researchers.
The Heartbleed security bug is a simple example of memory leakage through overflow vulnerability in the Heartbeat component of OpenSSL. Bits of memory in 64 kilobyte chunks may be extracted from the process’s memory. This could yield anything, including encryption keys, bits of traffic, credentials or session keys. The flaw is potentially among the most damaging ever to surface on the web but there's been little evidence that it has been widely exploited so far - leading some security experts to say it's been overblown.

However Ken Munro, a senior partner at Pen Test Partners, came across evidence of a real world) example of the vulnerability being exploited – in the popular online multiplayer game Call of Duty: Black Ops II. He logged in to shoot some enemies after a busy day of ethical hacking, only to see a series of messages suggesting a compromise had taken place.

"What we can surmise is that the CoD developers had connected to the Steam developer portal and either their session ID or, even worse, credentials had been stolen," Munro told El Reg.
"Fortunately whoever did this just decided to make it obvious; but imagine the damage that could have been caused by a malicious user. This is a prime game played (looking at Steam stats) by about 10,000 people a day. We could mess around with achievements, or even push a dodgy patch to cause a compromise of the all the players of the game!"

Chris Boyd, a malware intelligence analyst at anti-virus firm Malwarebytes, and a gaming security expert, agreed that Munro had uncovered circumstantial evidence of a compromise CoD while arguing that this might easily have been pulled off with another exploit.

"It's entirely possible the person responsible for the message didn't use Heartbleed to snag a login - they may have grabbed it by another means entirely, but decided to use the account to post a more general alert to the gaming community and devs at large," Boyd told El Reg. "In fact, this highlights the fact that we may see more compromises which have nothing to do with Heartbleed, but end up trading off the high profile of the threat.  This could lead to yet more confusion on the part of both developers and users of popular web services over the coming weeks."

Boyd agreed with Munro that the intention of the unknown perp was not malign.

"While it's difficult to say exactly what functionality the person responsible for compromising the game in this way had access to, it seems their intention was to warn rather than harm," Boyd said. "Anybody concerned about achievement tampering should know that it's easy enough for someone to do that themselves without an entire game needing to be compromised first. As for the possibility of malicious patches going out, PC updates are traditionally a little easier to get out than (say) the XBox Live network where all updates are put through rigorous testing before being given the green light."

Munro is sticking to his guns in suggesting Heartbleed is the most likely culprit.

"Timing-wise the most likely candidate is Heartbleed," Munro said, adding that Boyd is also right to say that "we only have the hacker’s claim - but that certainly doesn’t preclude it from being the truth."

Yet it is not sure whether it really is the HeartBleed or something else which has compromised Call of Duty: Black Ops II.

Continue reading →

Heartbleed snatched CloudFlare Crypto Keys!

Private crypto keys are accessible to Heartbleed hackers, new data shows. Cloudflare published preliminary findings that seemed to indicate that it would be difficult, if not impossible, to use Heartbleed to get the vital key that essentially unlocks the secure sockets layer padlock in millions of browsers. To be extra-sure, Cloudflare launched “The Heartbleed Challenge” to see how other people exploiting Heartbleed might fare. The company set up an nginx server running a Heartbleed-vulnerable version of OpenSSL and invited the Internet at large to steal its private key.
Four people have been able to see server keys and certificates in a test.


The results are a strong indication that merely updating servers to a version of OpenSSL that's not vulnerable to Heartbleed isn't enough. Because Heartbleed exploits don't by default show up in server logs, there's no way for sites that were vulnerable to rule out the possibility the private certificate key was plucked out of memory by hackers. Anyone possessing the private key can use it to host an impostor site that is virtually impossible for most end users to detect. Anyone visiting the bogus site would see the same https prefix and padlock icon accompanying the site's authentic server.

The demonstration that it's possible to extract private SSL certificates means that out of an abundance of caution, administrators of sites that used vulnerable versions of OpenSSL should revoke and replace old certificates with new ones as soon as possible. Given the huge number of sites affected, the revelation could create problems.

"The bad news is that discovery changes our recommendation from: reissue and revoke as a medium priority to reissue and revoke as a high priority," Matt Prince, CEO of CloudFlare wrote in an e-mail to Ars. "We've accelerated our own reissuance and revocation process."

Cloudflare had originally reasoned that, at least on the Linux-based platform it uses, a server's certificate and private keys are usually stored in the server's memory early on after booting up, and because servers are not booted up frequently, it would be difficult to find a situation in which the block of memory that Heartbleed can be used to access (which can be up to 64Kb of information) would contain a server's private keys.

The process of revoking and reissuing certificates is unwieldy and slow even without half of the Internet trying to do the same process at the same time. “If every site revoked its certificates, it would impose a significant burden and performance penalty on the Internet,” wrote CloudFlare in a Friday blog post. “At CloudFlare-scale the reissuance and revocation process could break the Certificate Authority infrastructure.”

The company said that for its customers running on CloudFlare infrastructure, it has already begun the process of reissuing and revoking SSL certificates in stages, and expects to be done with the process sometime next week.

Continue reading →

Oracle working on Heartbleed fixes

Oracle has emitted its formal advice about Heartbleed, revealing it has 13 products that need a patch and 14 more “which may be vulnerable”. Oracle points out that all its cloud services should be Heartbleed-proof and that six of its products – including Oracle Linux 6 and Solaris 10.2 – were vulnerable but can be patched with existing updates.


The news is not so good for the following products, as Oracle puts them in a bucket containing software that is “likely vulnerable but for which no fixes are yet available.”
1.    BlueKai
2.    Java ME - JSRs and Optional Packages
3.    Java ME - Mobile and Wireless
4.    MySQL Connector/C
5.    MySQL Connector/ODBC
6.    MySQL Workbench
7.    Oracle Communication Application Session Controller
8.    Oracle Communication Session Monitor
9.    Oracle Communications Internet Name and Address Management
10.    Oracle Communications Interactive Session Recorder 5.1
11.    Oracle Communications Network
12.    Oracle Communications WebRTC Session Controller
13.    Primavera P6 Prof Project Management

Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues.

Big Red also has another list of “products still under investigation, which may be vulnerable”. That list includes Oracle-branded fiber channel switches from Cisco and Qlogic, and the Sun Storage Common Array Manager.

Oracle has not, however, committed to a timetable to deliver patches. The post we've linked to says “Global Product Security will continue to follow up with the various product development teams within Oracle to monitor the creation of the appropriate fixes, determine whether additional products may be affected, and whether updated mitigation instructions are required.”

Continue reading →

50 million Android Phones vulnerable to Heartbleed , Data shows

Atleast four million android phones from U.S and tens of millions of android phones from world wide are vulnerable to the security flaw named "Heartbleed" which is now over-populated.

According to Google's announcement, Every device which is running android "Jelly Bean" software which means Android 4.1.1 released in 2012 is vulnerable.

Using data provided by the firm Chitika , It is the first time when an accurate estimate has been done on vulnerable devices. The android devices which are running Android 4.1 or 4.2 are not at risk.

Google has not provided the number of vulnerable android devices but they have indicated that the figure is less than 10% of world wide activated devices. It could be huge number as Google have activated about 900 million devices running with Google services world wide,  and there are hundreds of devices in China without Google services which is not shown in Google's system , that devices in China might be running vulnerable version.

"More than 80% of the people running Android 4.1 which have shared its data without looking are all affected," Marc Rogers, principal security researcher at the San Francisco-based company told.

Google released the first version of Android 4.1.1 in July 2012 which brought a bug fix for Nexus 7 tablets.

Only the version 4.1.1 uses the vulnerable version of OpenSSL as Google noticed it on a blog which was discussing the bugs affecting on Google products.

Continue reading →

HeartBleed - Critical Crypto Bug Exposes Yahoo Mail

OpenSSL is considered as a certificate for security but what when OpenSSL itself have a bug. That’s the reason Yahoo mail’s passwords were exposed. Heartbleed is a bug which is the result of a mundane coding error in OpenSSL. 

OpenSSL is for implementing HTTPS encryption in websites, e-mail servers, and applications. The result of a missing bounds check in the source code, Heartbleed allows attackers to recover large chunks of private computer memory that handle OpenSSL processes. The leak is the digital equivalent of a grab bag that hackers can blindly reach into over and over simply by sending a series of commands to vulnerable servers. The returned contents could include something as banal as a time stamp, or it could return far more valuable assets such as authentication credentials or even the private key at the heart of a website's entire cryptographic certificate.

After this bug and a huge loss to Yahoo Mail, OpenSSL developers have released version 1.0.1g that readers should install immediately on any vulnerable machines they maintain. But given the stakes and the time it takes to update millions of servers, the risks remain high.

This worked as by sending many requests at a time and get an entry into website through a hole because of heavy traffic. The bug allows to eavesdropping in a website who is using OpenSSL library.

The OpenSSL patch is only the starting point on the path of Heartbleed recovery. Website operators should strongly consider replacing their X.509 certificates after applying the update and getting all users and administrators to change passwords as well. 

Many websites have started to ask their users to change their passwords as soon as they have applied patch in their servers after knowing this attack and one of the example is most popular music website SOUNDCLUD.COM.

It's NOT probably so early for users to replace passwords across the board, but for sites they know have received the OpenSSL patch, it may be a good idea to change login credentials. People who are truly security conscious may want to change passwords a second time if they notice a patched site later updates its digital certificate.

It’s better to take step than cry later.

Continue reading →

Google kept the Heartbleed Bug hidden from Government

As the Heartbleed bug has been over-rated as thousands of websites were vulnerable to the exploit. Heartbleed might be one of the most famous bugs which have been over-rated  and the most famous exploit ever discovered till now but the researchers which found this exploit didn't revealed it to the world.

In the days of discovery of the bug , Different companies are working on its patch as its a serious bug which should be patched before the site is exploited , Oracle is working on Heartbleed bug fixes as we have heard.


Including big companies websites and other hundreds of website are vulnerable to Heartbleed bug and the companies have warned its customers about the bug exploitation and Oracle is working on its patches.

According to the report published by Sydney Morning Herald , NSA was blamed that NSA knew about the Heartbleed bug from a long time but they didn't leaked it.

After Bloomberg article was published last week, the agency spokesman Vanee told the Time Magzine that,  “NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report. Reports that say otherwise are wrong.”

The Google security researcher Neel Mehta discovered the Heartbleed bug on March 21 or before as SMH reported and by the evening the company created a patch for the vulnerability, The NSA too discovered the vulnerability.

“Eliminating the vulnerabilities — ‘patching’ them — strengthens the security of US government, critical infrastructure, and other computer systems,” the group urged President Barack Obama.

The mos interesting thing is that when Google discovered the Heartbleed vulnerability on March 21 so they even patched this vulnerability till the evening. 

Continue reading →

‘Oversight’ causes an error HeartBleed; says it’s Developer

Robin Seggelmann, a programmer based in Germany, submitted the code in an update submitted at 11:59pm on New Year's Eve, 2011. It was supposed to enable a function called "Heartbeat" in OpenSSL, the software package used by nearly half of all web servers to enable secure connections.
He says the "Heartbleed" vulnerability to the open-source code used by thousands of websites says it was an "oversight" – but that its discovery validates the methods used.

His update did enable Heartbeat, but an "oversight" led to an error with major ramifications. But it accidentally created the "Heartbleed" vulnerability, which has been described as a "catastrophic" flaw which laid the contents of thousands of web servers open to hackers.
Seggelmann worked on the OpenSSL project during his PhD studies, from 2008 to 2012, but isn't involved with the project any more.

It has also been discovered in Cisco and Juniper routing gear, which could mean that hackers could capture sensitive data such as passwords passing over the internet.

He said that the mistake has nothing to do with its festive datestamp. "The code… was the work of several weeks. It’s only a coincidence that it was submitted during the holiday season.

"I am responsible for the error," he continued, "because I wrote the code and missed the necessary validation by an oversight. Unfortunately, this mistake also slipped through the review process and therefore made its way into the released version."

Open source

OpenSSL is an open-source project. The software is developed by a small community of engineers, giving their time for little or no reward, and releasing it free of charge to anyone who needs it.
For security software, that model is typically seen as advantageous, because the more people examine a line of code, the more chance there should be of some weakness coming to light. Additionally, it prevents "security by obscurity", whereby the bulk of the protection comes from people not knowing how the security software works – which can result in the whole edifice tumbling down if that confidential information is released or discovered externally.

Instead, Seggelmann blamed the lack of resources that OpenSSL has to work with. "OpenSSL is definitely under-resourced for its wide distribution. It has millions of users but only very few actually contribute to the project."

How Heartbleed works

The flaw which actually leaks data in the Heartbleed bug is almost painfully simple.
It relates to a function called Heartbeat which exists in "Transport Layer Security" (TLS), the system used to protect confidential data when surfing the web. Heartbeat is used to keep connections open, even when no data is being shared.

When it works properly, a user's computer sends a Heartbeat packet to the server. The packet simply contains a chunk of random data, and a note saying how much data it's sent; the server receives the packet, and then sends back exactly the same data, confirming that it's listening.
The problem which can be exploited in a Heartbleed attack involves the attacker's computer lying about how much data it has sent: it sends over a single byte of information, but tells the server that it has sent 64KB instead. The server makes a note, and knows that it has to send 64KB back, but doesn't have a full 64KB of data.

What pushes the error into a full-blown catastrophe is that the server then fills the rest of the packet with any other information which its memory at the time.

A computer's memory is where it stores information about the tasks it's working on, and so the data which it pulls into the Heartbleed packet is related to the other queries it's responding to. At Yahoo, that included usernames and passwords of users logging in at the same time; at DuckDuckGo, it was the full text of search queries. The researchers who discovered the bug also say it can include SSL keys, which would let an attacker decrypt conversations captured months before.

Continue reading →

VPN is Still Vulnerable to Heartbleed

Researchers earlier this month guessed heartbleed had infected two-thirds of all Web servers, and researchers at Sucuri reported Friday that just 2 percent of the top 1 million websites on the Internet remain infected and all of the top 1,000 sites have been patched against the OpenSSL vulnerability but Mandiant tracks a scary new attack vector--VPN user sessions.

But also on Friday, Mandiant researchers reported an attack they tracked beginning on April 8 in which an attacker "leveraged the Heartbleed vulnerability in a SSL VPN concentrator to remotely access our client's environment," culminating in the hijacking of "multiple active user sessions."
Mandiant said the attackers exploited the security vulnerability in OpenSSL running in the client’s SSL VPN concentrator to remotely access active sessions.

This is just the latest in an escalating series of attacks leveraging Heartbleed, which is a problem in OpenSSL’s heartbeat functionality, which if enabled, returns 64KB of memory in plaintext to any client or server requesting a connection. Already, there have been reports of attackers using Heartbleed to steal user names, session IDs, credentials and other data in plaintext. Late last week came the first reports of researchers piecing together enough information to successfully reproduce a private SSL key.

Mandiant said the attacker was able to steal active user session tokens in order to bypass the organization’s multifactor authentication and VPN client software used to validate the authenticity of systems connecting to network resources.

The Mandiant researchers recommended that all organizations running remote access software and appliances determined to be vulnerable to the Heartbleed exploit both upgrade with available patches immediately and review their VPN logs to see if an attack had occurred in the past.

Continue reading →

Hacker arrested by Canadan Police for exploiting HeartBleed Bug

A 19-year-old man is arrested and charged by Canadian police a who allegedly exploited the Heartbleed bug to steal personal data from the Canadian Revenue Agency's website.

Stephen Arthuro Solis-Reyes, who allegedly grabbed 900 social insurance numbers (SINs) over a period of six hours, marks the first time that authorities have apprehended someone in relation to the bug in OpenSSL.

Solis-Reyes of London, Ontario is a student at Western University, was detained by the London Police Service and the Royal Canadian Mounted Police National Division Integrated Technological Crime Unit.

In a statement, Assistant Commissioner Gilles Michaud of the RCMP, said:
The RCMP treated this breach of security as a high priority case and mobilized the necessary resources to resolve the matter as quickly as possible. Investigators from National Division, along with our counterparts in "O" Division have been working tirelessly over the last four days analyzing data, following leads, conducting interviews, obtaining and executing legal authorizations and liaising with our partners.

He is scheduled to appear in court in Ottowa on 17 July 2014.

Canada's tax agency was one of the first major organizations to be impacted by the Heartbleed flaw and subsequently had to remove public access to its online services for four days in order to protect taxpayer information.

It's unclear what Solis-Reyes's motivations were. But it's important to remember that while security researchers and other interested parties may like to think that testing for Heartbleed or other vulnerabilities may be ethical and useful in purpose, the law may not agree.

Such activity may not be regulated in every nation, but some countries certainly do prohibit the testing of security on third-party websites without permission.

Furthermore, it should be obvious that actually exploiting any discovered vulnerabilities in order to gain unauthorized access to networks and data is a bad idea at all times. More so if the organization in question is your national tax office.

If you do have legitimate concerns about a website's security, the correct course of action would be to notify the owners and engage in responsible disclosure in a manner that doesn't place other people's data at jeopardy.

Continue reading →

How Heartbleed Bug Exposes Your Passwords to Hackers

Are you safe from the critical bug Heartbleed?? OpenSSL- the encryption technology used by millions of websites to encrypt the communication and is also used to protect our sensitive data such as e-mails, passwords or banking information. But a tiny, but most critical flaw called "Heartbleed" in the widely used OpenSSL opened doors for the cyber criminals to extract sensitive data from the system memory.SSL and TLS are known to provide communication security and privacy over the Internet for applications such as websites, email, instant messaging (IM), including some virtual private networks (VPNs).Heartbleed is a critical bug (CVE-2014-0160) is in the popular OpenSSL cryptographic software library, that actually resides in the OpenSSL's implementation of the TLS (transport layer security protocols) and DTLS (Datagram TLS) heartbeat extension (RFC6520).This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon, while improving the SafeGuard feature in Codenomicon's Defensics security testing tools, and Neel Mehta of Google Security, who first reported it to the OpenSSL team.Software vulnerabilities may come and go, but this bug is more critical as it has left the large number of private keys and other secrets exposed to the Internet. The heartbleed bug can reveal the contents of a server's memory, where the most sensitive data is stored, including the private data such as usernames, passwords, and credit card numbers. This could allow attackers to retrieve private keys and ultimately decrypt the server's encrypted traffic or even impersonate the server.

“The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.”

OpenSSL is most widely used cryptographic library for Apache and nginx Web servers, which handles a service of Transport Layer Security (TLS) called Heartbeat, an extension added to TLS in 2012. The combined market share of just those two, Apache and nginx, out of the active sites on the Internet is over 66% according to Netcraft's April 2014 Web Server Survey.Moreover, OpenSSL is used to protect email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Many large consumer sites are also saved by their conservative choice of SSL/TLS termination equipment and software. OpenSSL is also very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates.

Security researcher 'Robert Graham' scanned the Internet and found that more than 600,000 servers are vulnerable to heartbleed flaw, including Yahoo.com, imgur.com, flickr.com, hidemyass.com. [List]

Because of Heartbleed bug, the Canada Revenue Agency was forced to shut down its electronic tax collection service yesterday and apparently, World's biggest audio platform SoundCloud also logged out its users for fixing this flaw.Yahoo, which has more than 800 million users around the world, also has been exposed by the bug.

HOW HEARTBLEED WORKS?It is not a problem with the TLS/SSL technologies that encrypt the Internet, neither with how OpenSSL works. It is just a dumb coding mistake.

Using Heartbeats extension two computers make sure the other is still alive by sending data back and forth to each other. The client (user) sends its heartbeat to the server (website), and the server hands it right back. If by chance anyone of them goes down during the transaction, the other one will know using heartbeat sync mechanism.

When that heartbeat is sent, a small amount of the server’s short-term memory of about 64 kilobytes comes in reply from server and an attacker is supposed to grab it, that can leak sensitive data such as message contents, user credentials, session keys and server private keys. By sending heartbleed requests multiple times, an attacker is able to fetch more memory contents from the server.

This means, everything and anything in the memory such as SSL private keys, user keys used for your usernames and passwords, instant messages, emails and business critical documents and communication, and many more is vulnerable to cyber criminals. At this phase, you have to assume that it is all compromised.

About two-thirds of web servers rely on OpenSSL, means the information passing through hundreds of thousands of websites could be vulnerable.

So far, Security experts have found no direct evidence that anyone has managed to use the bug to steal information. The vulnerability has been fixed in OpenSSL v1.0.1g.

Major websites, including Gmail and YouTube, Facebook, Tumblr, Yahoo and Dropbox have fixed the problem, but there are still thousands of websites who are yet to fix the problem. Users are advised to change their passwords on only those affected websites, that tell you they've fixed the problem. READ MORE on how to protect yourself from Heartbleed bug.

Continue reading →

Heartbleed - OpenSSL Zero-day Bug leaves Millions of websites Vulnerable

It is advised to those who are running their web server with OpenSSL 1.0.1 through 1.0, then it is significantly important that you update to OpenSSL 1.0.1g immediately or as soon as possible. As this afternoon, an extremely critical programming flaw in the OpenSSL has been discovered that apparently exposed the cryptographic keys and private data from some of the most important sites and services on the Internet.The bug was independently discovered by security firm Codenomicon along with a Google Security engineer. The flaw is in the popular OpenSSL cryptographic software library and its weakness allows cyber criminals to steal the information protected, under normal conditions, by the SSL (Secure Sockets Layer) or TLS (Transport Security Layer) encryption used to secure the Internet.OpenSSL is an open-source implementation of the SSL and TLS protocols. The core library implements the basic cryptographic functions that enable SSL and TLS encryption. Mostly every websites use either SSL or TLS, even the Apache web server that powers almost half of the websites over internet utilizes OpenSSL.The discoverer of the vulnerability dubbed the bug as ‘Heartbleed bug’, as the exploit rests on a bug in the implementation of OpenSSL’s TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520).This critical bug with code ID CVE-2014-0160, could allows an attacker to expose up to 64kB of memory from the server or a connected client computer running a vulnerable version of OpenSSL software. Specifically, this means that an attacker can steal keys, passwords and other private information remotely.“We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, usernames and passwords, instant messages, emails and business critical documents and communication.”The vulnerability in the OpenSSL’s transport layer security (TSL) protocols’ heartbeat section has been in the wild since March 2012 and is supposed to be even more dangerous than Apple’s recent SSL bug, which outcropped the possibility for man-in-the-middle (MitM) attacks.As the Heartbleed bug reveals encryption keys that could lead to other compromises, affects past traffic and may affect as much as 66 percent of Internet websites over the internet. 10 out of top 1000 sites are vulnerable to this flaw, including Yahoo Mail, Lastpass and the FBI site. There also is a proof-of-concept exploit for the flaw posted on Github. On this website, you can check if your web server is vulnerable or not."Bugs in single software or library come and go and are fixed by new versions," the researchers who discovered the vulnerability wrote in a blog post published Monday. "However this bug has left a large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitations and attacks leaving no trace this exposure should be taken seriously."Fixes for the bug have been released by the researchers. So, who are running the OpenSSL 1.0.1f version may update to OpenSSL 1.0.1g. The users running older version of OpenSSL are safe.

Continue reading →

Billions of Smartphone Users affected by Heartbleed Vulnerability

Heartbleed has left a worst impression worldwide affecting millions of websites and is also supposed to put millions of Smartphones and tablets users at a great risk.Heartbleed is a critical bug (CVE-2014-0160) in the popular OpenSSL cryptographic software library, that actually resides in the OpenSSL's implementation of the TLS/DTLS heartbeat extension, which allows attackers to read portions of the affected server’s memory, potentially revealing users data such as usernames, passwords, and credit card numbers, that the server did not intend to reveal.OpenSSL is a widely-used cryptographic library which implements the SSL and TLS protocol and protects communications on the Internet, and mostly every websites use either SSL or TLS, even the Apache web server that powers almost half of the websites over internet utilizes OpenSSL.But to assume that the users using desktop browsers to visit websites are vulnerable to the Heartbleed bug, will be wrong. Despite 40-60 billion active Smartphone applications may be sharing some of those same servers or connect to their own group of servers that may also be compromised.Google wrote in an update on its Online Security blog on Wednesday, emphasizing that Android was not vulnerable to the Heartbleed bug, except for a very specific version and can you guess that so called specific version??Android 4.1.1 Jelly Bean, the one which makes up the majority of Android devices around the world, and which relies on the vulnerable version of OpenSSL.Google didn’t reveal the actual figure that are vulnerable to the bug, but according to the latest dashboard released by Google, it is estimated that around 34.4% of the Android devices in use today are running the Android 4.1.x version. Even last September Google announced that it had activated one billion devices. This means that the minimal number is likely to be in the millions. So, one can imagine how many Smartphones and tablets were at risk.Well, Google has released the patches for Android 4.1.1 which is being distributed among the Android partners.Apple users can be relaxed knowing that their devices running iOS and OS X are not affected by the most critical security flaw, Heartbleed."Apple takes security very seriously. IOS and OS X never incorporated the vulnerable software and key web-based services were not affected," Apple told Re/code.Instead using OpenSSL, Apple relies on different SSL/TLS libraries called Secure Transport, which was hit by its own very serious bug in February outcropping the possibility for man-in-the-middle (MitM) attacks — though it wasn't as dangerous as the recent OpenSSL Heartbleed security Flaw.But still Apple users were not exempted completely, as the users using BBM for private messages on iOS might have been vulnerable to this flaw.Blackberry confirmed that some of its products, including Secure Work Space for iOS and Android, and BlackBerry Link for Windows and Mac OS and even BBM for iOS and Android were vulnerable to the Heartbleed security flaw. The figure of affected users is not least, as about 80 million people use BBM service.They have also assured that BlackBerry Smartphones and tablets, BlackBerry Enterprise Server 5, BlackBerry Enterprise Service 10, and the BlackBerry Infrastructure are not affected by the flaw and are fully protected.

Continue reading →

How to Protect yourself from the 'Heartbleed' Bug

Millions of websites, users' passwords, credit card numbers and other personal information may be at risk as a result of the Heartbleed security flaw, a vulnerability in widely used cryptographic library 'OpenSSL'. [READ DETAILS HERE]

Netcraft survey says that about half a million widely trusted active websites on the internet are vulnerable to the heartbleed bug, which means the information transmitting through hundreds of thousands of websites could be vulnerable, despite the protection offered by encryption techniques.

According to Netcraft, “the heartbeat extension was enabled on 17.5% of SSL sites, accounting for around half a million certificates issued by trusted certificate authorities. These certificates are consequently vulnerable to being spoofed (through private key disclosure), allowing an attacker to impersonate the affected websites without raising any browser warnings.”Among the trusted names running OpenSSL is Yahoo!, which has been affected by this critical flaw. Yes, Yahoo Inc., which boasts more than 800 million users worldwide, is among the Internet services that could be potentially hurt by Heartbleed.The bug leaks the below given information, although Yahoo! has since patched its systems.The Popular sites which exhibit support for the TLS heartbeat extension also include Twitter, Facebook, GitHub, Bank of America, DropBox are not currently vulnerable, but it is unclear that they were vulnerable few days ago.Including Yahoo!, Flickr, Tumbler, Google, OKCupid and even the anonymous search engine DuckDuckGo was vulnerable, which has now been fixed.Yahoo Inc. said that it has "successfully made appropriate corrections" to the main Yahoo properties, including Yahoo Homepage, Search, Mail, Finance, Sports, Food, Tech, Flickr and Tumblr.You can see the Heartbleed mass-test when performed around 8th April from here. In the list, the websites shown vulnerable may not be vulnerable right now.
HOW TO CHECK IF YOUR FAVORITE WEBSITES ARE VULNERABLE1.) First of all check if the sites you use every day on an individual basis are vulnerable to Heartbleed bug or not using http://filippo.io/Heartbleed/, and if you're given a red flag, avoid the site for now.

2.) LastPass also created a Web app that will tell you what kind of encryption a site uses, and when the encryption was last updated.

3.) Provensec also created a scanner at http://provensec.com/heartbleed/

4.) GlobalSign SSL Configuration Checker.

5.) The easiest way to keep you safe is to use a new add-on to the Chrome browser, Chromebleed, created by security researcher, Jamie Hoyle.

HOW TO PROTECT YOURSELF FROM HEARTBLEED
If the site you use is not affected by the vulnerability, its good idea that you change your password immediately, assuming that it was vulnerable before, just to make sure that you are now safe. But changing the password before the bug is fixed could compromise your new password as well.

You are advised to don't reuse the same passwords on different websites and try to use a separate password for each website.

If you are using a public Wi-Fi at MacDonald or any other public places, then you should limit your Internet behavior and avoid sign in into websites that are especially sensitive.

OpenSSL version 1.0.1 through 1.0.1f and 1.0.2-beta1 are Vulnerable and flaw is fixed in OpenSSL 1.0.1g. If you haven't yet, please update your system that use OpenSSL for TLS encrypted communications.

And last but not the least; keep an eye on every financial transaction, and it is good practice to use two-factor authentication, which means with the password, the account requires a freshly generated pass code that shows up only on your personal smartphone, before getting into certain sites.

Stay Secure! Stay Tuned.

Continue reading →

NSA denies Report that Agency knew and exploited Heartbleed Vulnerability

The Bloomberg claimed that the U.S. National Security Agency (NSA) knew about the most critical Heartbleed flaw and has been using it on a regular basis to gather “critical intelligence” and sensitive information for at least past two years and decided to keep the bug secret, citing two sources ‘familiar with the matter’.In response to the above report, NSA has issued a '94 character' statement today denying the claims that it has known about the Heartbleed bug since two years and that it has been using it silently for the purpose of surveillance."NSA was not aware of the recently identified Heartbleed vulnerability until it was made public," the U.S. intelligence agency said on its Twitter feed.Heartbleed is one of the biggest Internet vulnerabilities in recent history that left large number of cryptographic keys and private data such as usernames, passwords, and credit card numbers, from the most important sites and services on the Internet open for hackers. The bug resides in the "Heartbeat" feature of the most secured open source encryption protocol, OpenSSL, which is used by several social networks, search engines, banks and other websites to enable secure connections while transmitting data.A team of researchers from Codenomicon and Google Security researcher revealed the vulnerability this week that is in the wild since the new version 1.0.1f was released in March 2012. And just after the revelation, OpenSSL released the security Fix for the bug in its version 1.0.1g, but until then the Heartbleed bug made websites, email, instant messaging (IM), including some virtual private networks, on about half a million of the world's widely trusted web servers, open to hackers.The birth of the most critical bug Heartbleed was due to a mistake done by a German programmer Robin Seggelmann over two years ago while working on a new Heartbeat feature in the OpenSSL.He submitted the code of OpenSSL with the heartbeat feature in an update on New Year's Eve, 2011, and an “oversight” led to an error that unintentionally created the “Heartbleed” vulnerability.Yesterday he said it could be entirely possible that the government intelligence agencies had been making use of this critical flaw over the past two years.The fix was released just after, but the users’ data are vulnerable until the vulnerable websites didn’t implement it. You can only change your password immediately for those websites that are not affected, assuming that it was vulnerable before, just to make sure that you are now safe.Follow me on Google+, Twitter or LinkedIn or Contact via Email.

View the original article here

Continue reading →