Philippine Tech

Changing IP Via Mozilla Fire Fox

Changing IP Via Mozilla Fire Fox

This Tut Is Created by my own ! Copy This With Rights :)

01:51

The HeartBleed Bug

<div class="row" style="box-sizing: border-box; margin-left: -15px; margin-right: -15px;">
<div class="col-lg-8 col-md-8 col-sm-8 col-lg-pull-4 col-md-pull-4 col-sm-pull-4" style="box-sizing: border-box; float: left; min-height: 1px; padding-left: 15px; padding-right: 15px; position: relative; right: 323.328125px; width: 646.65625px;">
<div style="box-sizing: border-box; margin-bottom: 10px;">
The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).</div>
<div style="box-sizing: border-box; margin-bottom: 10px;">
The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.</div>
</div>
</div>
<div class="row" style="box-sizing: border-box; margin-left: -15px; margin-right: -15px;">
<div class="col-lg-6 col-md-6 col-sm-6" style="box-sizing: border-box; float: left; min-height: 1px; padding-left: 15px; padding-right: 15px; position: relative; width: 485px;">
<h3 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 1.2em; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What leaks in practice?</h3>
<div style="box-sizing: border-box; margin-bottom: 10px;">
We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.</div>
</div>
<div class="col-lg-6 col-md-6 col-sm-6" style="box-sizing: border-box; float: left; min-height: 1px; padding-left: 15px; padding-right: 15px; position: relative; width: 485px;">
<h3 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 1.2em; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
How to stop the leak?</h3>
<div style="box-sizing: border-box; margin-bottom: 10px;">
As long as the vulnerable version of OpenSSL is in use it can be abused. <a href="https://www.openssl.org/news/secadv_20140407.txt" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Fixed OpenSSL</a> has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.</div>
</div>
</div>
<div class="row" style="box-sizing: border-box; margin-left: -15px; margin-right: -15px;">
<div class="col-lg-12 col-md-12 col-sm-12" style="box-sizing: border-box; float: left; min-height: 1px; padding-left: 15px; padding-right: 15px; position: relative; width: 970px;">
<hr style="background-color: white; border-bottom-width: 0px; border-left-width: 0px; border-right-width: 0px; border-top-color: rgb(238, 238, 238); border-top-style: solid; box-sizing: content-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; height: 0px; line-height: 28.571430206298828px; margin: 3em 0px;" />
<h3 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 1.2em; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Q&A</h3>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What is the CVE-2014-0160?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
CVE-2014-0160 is the official reference to this bug. CVE (Common Vulnerabilities and Exposures) is the Standard for Information Security Vulnerability Names maintained by <a href="http://cve.mitre.org/" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">MITRE</a>. Due to co-incident discovery a duplicate CVE, CVE-2014-0346, which was assigned to us, should not be used, since others independently went public with the CVE-2014-0160 identifier.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Why it is called the Heartbleed Bug?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Bug is in the OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What makes the Heartbleed Bug unique?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Is this a design flaw in SSL/TLS protocol specification?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
No. This is implementation problem, i.e. programming mistake in popular OpenSSL library that provides cryptographic services such as SSL/TLS to the applications and services.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What is being leaked?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories: 1) primary key material, 2) secondary key material and 3) protected content and 4) collateral.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What is leaked primary key material and how to recover?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
These are the crown jewels, the encryption keys themselves. Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. All this has to be done by the owners of the services.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What is leaked secondary key material and how to recover?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
These are for example the user credentials (user names and passwords) used in the vulnerable services. Recovery from this leaks requires owners of the service first to restore trust to the service according to steps described above. After this users can start changing their passwords and possible encryption keys according to the instructions from the owners of the services that have been compromised. All session keys and session cookies should be invalidated and considered compromised.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What is leaked protected content and how to recover?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
This is the actual content handled by the vulnerable services. It may be personal or financial details, private communication such as emails or instant messages, documents or anything seen worth protecting by encryption. Only owners of the services will be able to estimate the likelihood what has been leaked and they should notify their users accordingly. Most important thing is to restore trust to the primary and secondary key material as described above. Only this enables safe use of the compromised services in the future.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What is leaked collateral and how to recover?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Leaked collateral are other details that have been exposed to the attacker in the leaked memory content. These may contain technical details such as memory addresses and security measures such as canaries used to protect against overflow attacks. These have only contemporary value and will lose their value to the attacker when OpenSSL has been upgraded to a fixed version.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Recovery sounds laborious, is there a short cut?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
After seeing what we saw by "attacking" ourselves, with ease, we decided to take this very seriously. We have gone laboriously through patching our own critical services and are dealing with possible compromise of our primary and secondary key material. All this just in case we were not first ones to discover this and this could have been exploited in the wild already.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
How revocation and reissuing of certificates works in practice?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
If you are a service provider you have signed your certificates with a Certificate Authority (CA). You need to check your CA how compromised keys can be revoked and new certificate reissued for the new keys. Some CAs do this for free, some may take a fee.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Am I affected by the bug?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
You are likely to be affected either directly or indirectly. OpenSSL is the most popular open source cryptographic library and TLS (transport layer security) implementation used to encrypt traffic on the Internet. Your popular social site, your company's site, commerce site, hobby site, site you install software from or even sites run by your government might be using vulnerable OpenSSL. Many of online services use TLS to both to identify themselves to you and to protect your privacy and transactions. You might have networked appliances with logins secured by this buggy implementation of the TLS. Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
How widespread is this?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66% according to <a href="http://news.netcraft.com/archives/2014/04/02/april-2014-web-server-survey.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Netcraft's April 2014 Web Server Survey</a>. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Fortunately many large consumer sites are saved by their conservative choice of SSL/TLS termination equipment and software. Ironically smaller and more progressive services or those who have upgraded to latest and best encryption will be affected most. Furthermore OpenSSL is very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What versions of the OpenSSL are affected?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Status of different versions:</div>
<ul style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;">
<li style="box-sizing: border-box;">OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable</li>
<li style="box-sizing: border-box;">OpenSSL 1.0.1g is NOT vulnerable</li>
<li style="box-sizing: border-box;">OpenSSL 1.0.0 branch is NOT vulnerable</li>
<li style="box-sizing: border-box;">OpenSSL 0.9.8 branch is NOT vulnerable</li>
</ul>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
How common are the vulnerable OpenSSL versions?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
The vulnerable versions have been out there for over two years now and they have been rapidly adopted by modern operating systems. A major contributing factor has been that TLS versions 1.1 and 1.2 came available with the first vulnerable OpenSSL version (1.0.1) and security community has been pushing the TLS 1.2 due to earlier attacks against TLS (such as the <a href="http://en.wikipedia.org/wiki/Transport_Layer_Security#BEAST_attack" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">BEAST</a>).</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
How about operating systems?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:</div>
<ul style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;">
<li style="box-sizing: border-box;">Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4</li>
<li style="box-sizing: border-box;">Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11</li>
<li style="box-sizing: border-box;">CentOS 6.5, OpenSSL 1.0.1e-15</li>
<li style="box-sizing: border-box;">Fedora 18, OpenSSL 1.0.1e-4</li>
<li style="box-sizing: border-box;">OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)</li>
<li style="box-sizing: border-box;">FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013</li>
<li style="box-sizing: border-box;">NetBSD 5.0.2 (OpenSSL 1.0.1e)</li>
<li style="box-sizing: border-box;">OpenSUSE 12.2 (OpenSSL 1.0.1c)</li>
</ul>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Operating system distribution with versions that are not vulnerable:</div>
<ul style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;">
<li style="box-sizing: border-box;">Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14</li>
<li style="box-sizing: border-box;">SUSE Linux Enterprise Server</li>
<li style="box-sizing: border-box;">FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013</li>
<li style="box-sizing: border-box;">FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013</li>
<li style="box-sizing: border-box;">FreeBSD 10.0p1 - OpenSSL 1.0.1g (At 8 Apr 18:27:46 2014 UTC)</li>
<li style="box-sizing: border-box;">FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)</li>
</ul>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
How can OpenSSL be fixed?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Even though the actual code fix may appear trivial, OpenSSL team is the expert in fixing it properly so fixed version 1.0.1g or newer should be used. If this is not possible software developers can recompile OpenSSL with the handshake removed from the code by compile time option <code style="background-color: #f9f2f4; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 18px; padding: 2px 4px; white-space: nowrap;">-DOPENSSL_NO_HEARTBEATS</code>.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Should heartbeat be removed to aid in detection of vulnerable services?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Recovery from this bug might have benefitted if the new version of the OpenSSL would both have fixed the bug and disabled heartbeat temporarily until some future version. Majority, if not almost all, of TLS implementations that responded to the heartbeat request at the time of discovery were vulnerable versions of OpenSSL. If only vulnerable versions of OpenSSL would have continued to respond to the heartbeat for next few months then large scale coordinated response to reach owners of vulnerable services would become more feasible. However, swift response by the Internet community in developing online and standalone detection tools quickly surpassed the need for removing heartbeat altogether.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Can I detect if someone has exploited this against me?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Exploitation of this bug leaves no traces of anything abnormal happening to the logs.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Can IDS/IPS detect or block this attack?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Although the heartbeat can appear in different phases of the connection setup, intrusion detection and prevention systems (IDS/IPS) rules to detect heartbeat have been developed. Due to encryption differentiating between legitimate use and attack can not be based on the content of the request, but the attack may be detected by comparing the size of the request against the size of the reply. This implies that IDS/IPS can be programmed to detect the attack but not to block it unless heartbeat requests are blocked altogether.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Has this been abused in the wild?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
We don't know. Security community should deploy TLS/DTLS honeypots that entrap attackers and to alert about exploitation attempts.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Can attacker access only 64k of the memory?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Is this a MITM bug like Apple's goto fail bug was?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
No this doesn't require a man in the middle attack (MITM). Attacker can directly contact the vulnerable service or attack any user connecting to a malicious service. However in addition to direct threat the theft of the key material allows man in the middle attackers to impersonate compromised services.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Does TLS client certificate authentication mitigate this?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
No, heartbeat request can be sent and is replied to during the handshake phase of the protocol. This occurs prior to client certificate authentication.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Does OpenSSL's FIPS mode mitigate this?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
No, OpenSSL Federal Information Processing Standard (FIPS) mode has no effect on the vulnerable heartbeat functionality.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Does Perfect Forward Secrecy (PFS) mitigate this?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Use of Perfect Forward Secrecy (PFS), which is unfortunately rare but powerful, should protect past communications from retrospective decryption. Please see<a href="https://twitter.com/ivanristic/status/453280081897467905" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">https://twitter.com/ivanristic/status/453280081897467905</a> how leaked tickets may affect this.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Can heartbeat extension be disabled during the TLS handshake?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
No, vulnerable heartbeat extension code is activated regardless of the results of the handshake phase negotiations. Only way to protect yourself is to upgrade to fixed version of OpenSSL or to recompile OpenSSL with the handshake removed from the code.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Who found the Heartbleed Bug?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at<a href="http://www.codenomicon.com/" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Codenomicon</a> and Neel Mehta of Google Security, who first reported it to the OpenSSL team. Codenomicon team found heartbleed bug while improving the SafeGuard feature in Codenomicon's Defensics security testing tools and reported this bug to the NCSC-FI for vulnerability coordination and reporting to OpenSSL team.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What is the Defensics SafeGuard?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
The SafeGuard feature of the Codenomicon's Defensics security testtools automatically tests the target system for weaknesses that compromise the integrity, privacy or safety. The SafeGuard is systematic solution to expose failed cryptographic certificate checks, privacy leaks or authentication bypass weaknesses that have exposed the Internet users to man in the middle attacks and eavesdropping. In addition to the Heartbleed bug the new Defensics TLS Safeguard feature can detect for instance the exploitable security flaw in widely used GnuTLS open source software implementing SSL/TLS functionality and the <a href="http://gotofail.com/" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">"goto fail;"</a> bug in Apple's TLS/SSL implementation that was patched in February 2014.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Who coordinates response to this vulnerability?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
Immediately after our discovery of the bug on 3rd of April 2014, <a href="https://www.cert.fi/en/index.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">NCSC-FI</a> took up the task of verifying it, analyzing it further and reaching out to the authors of OpenSSL, software, operating system and appliance vendors, which were potentially affected. However, this vulnerability had been found and details released independently by others before this work was completed. Vendors should be notifying their users and service providers. Internet service providers should be notifying their end users where and when potential action is required.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Is there a bright side to all this?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
For those service providers who are affected this is a good opportunity to upgrade security strength of the secret keys used. A lot of software gets updates which otherwise would have not been urgent. Although this is painful for the security community, we can rest assured that infrastructure of the cyber criminals and their secrets have been exposed as well.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
What can be done to prevent this from happening in future?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
The security community, we included, must learn to find these inevitable human mistakes sooner. Please support the development effort of software you trust your privacy to. <a href="https://www.openssl.org/support/donations.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Donate money to the OpenSSL project.</a></div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
Where to find more information?</h4>
<div style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px;">
This Q&A was published as a follow-up to the OpenSSL advisory, since this vulnerability became public on 7th of April 2014. The OpenSSL project has made a statement at<a href="https://www.openssl.org/news/secadv_20140407.txt" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">https://www.openssl.org/news/secadv_20140407.txt</a>. NCSC-FI published an advisory at<a href="https://www.cert.fi/en/reports/2014/vulnerability788210.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">https://www.cert.fi/en/reports/2014/vulnerability788210.html</a>. Individual vendors of operating system distributions, affected owners of Internet services, software packages and appliance vendors may issue their own advisories.</div>
<h4 style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; font-weight: 400; line-height: 1.1; margin: 2em 0px 0.5em;">
References</h4>
<ul style="background-color: white; box-sizing: border-box; color: #222222; font-family: Lato, sans-serif; font-size: 20px; line-height: 28.571430206298828px; margin-bottom: 10px; margin-top: 0px;">
<li style="box-sizing: border-box;">CVE-2014-0160</li>
<li style="box-sizing: border-box;">NCSC-FI case# 788210</li>
<li style="box-sizing: border-box;"><a href="https://www.openssl.org/news/secadv_20140407.txt" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">OpenSSL Security Advisory</a> <small style="box-sizing: border-box; font-size: 17px;">(published 7th of April 2014, ~17:30 UTC)</small></li>
<li style="box-sizing: border-box;"><a href="http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerabilities" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">CloudFlare: Staying ahead of OpenSSL vulnerabilities</a> <small style="box-sizing: border-box; font-size: 17px;">(published 7th of April 2014, ~18:00 UTC)</small></li>
<li style="box-sizing: border-box;"><a href="http://heartbleed.com/" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">heartbleed.com</a> <small style="box-sizing: border-box; font-size: 17px;">(published 7th of April 2014, ~19:00 UTC)</small></li>
<li style="box-sizing: border-box;"><a href="http://www.ubuntu.com/usn/usn-2165-1/" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Ubuntu / Security Notice USN-2165-1</a></li>
<li style="box-sizing: border-box;"><a href="http://www.freshports.org/security/openssl/" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">FreshPorts / openssl 1.0.1_10</a></li>
<li style="box-sizing: border-box;"><a href="https://blog.torproject.org/blog/openssl-bug-cve-2014-0160" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Tor Project / OpenSSL bug CVE-2014-0160</a></li>
<li style="box-sizing: border-box;"><a href="https://rhn.redhat.com/errata/RHSA-2014-0376.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">RedHat / RHSA-2014:0376-1</a></li>
<li style="box-sizing: border-box;"><a href="http://lists.centos.org/pipermail/centos-announce/2014-April/020249.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">CentOS / CESA-2014:0376</a></li>
<li style="box-sizing: border-box;"><a href="https://lists.fedoraproject.org/pipermail/announce/2014-April/003205.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Fedora / Status on CVE-2014-0160</a></li>
<li style="box-sizing: border-box;"><a href="http://www.kb.cert.org/vuls/id/720951" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">CERT/CC (USA)</a></li>
<li style="box-sizing: border-box;"><a href="https://www.cert.fi/en/reports/2014/vulnerability788210.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">NCSC-FI (Finland)</a></li>
<li style="box-sizing: border-box;"><a href="https://www.cert.at/warnings/all/20140408.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">CERT.at (Austria)</a></li>
<li style="box-sizing: border-box;"><a href="http://www.circl.lu/pub/tr-21/" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">CIRCL (Luxembourg)</a></li>
<li style="box-sizing: border-box;"><a href="http://www.cert.ssi.gouv.fr/site/CERTFR-2014-ALE-003/index.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">CERT-FR (France)</a></li>
<li style="box-sizing: border-box;"><a href="https://www.jpcert.or.jp/at/2014/at140013.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">JPCERT/CC (Japan)</a></li>
<li style="box-sizing: border-box;"><a href="https://www.cert.se/2014/04/ny-sarbarhet-i-openssl-1-0-1" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">CERT-SE (Sweden)</a></li>
<li style="box-sizing: border-box;"><a href="https://www.nsm.stat.no/Arbeidsomrader/Internettsikkerhet-NorCERT/Forsideartikler-NorCERT/Alvorlig-sarbarhet-i-SSL/" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">NorCERT (Norway)</a></li>
<li style="box-sizing: border-box;"><a href="https://www.ncsc.nl/dienstverlening/expertise-advies/factsheets/factsheet-heartbleed-ernstige-kwetsbaarheid-in-openssl.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">NCSC-NL (Netherlands)</a></li>
<li style="box-sizing: border-box;"><a href="http://www.cert.org.cn/publish/main/9/2014/20140410091311360563426/20140410091311360563426_.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">CNCERT/CC (People's Republic of China)</a></li>
<li style="box-sizing: border-box;"><a href="http://www.publicsafety.gc.ca/cnt/rsrcs/cybr-ctr/2014/av14-017-eng.aspx" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Public Safety Canada</a></li>
<li style="box-sizing: border-box;"><a href="https://cert.litnet.lt/lt/dokumentai/heartbleed-openssl-pazeidziamumas" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">LITNET CERT (Lithuania)</a></li>
<li style="box-sizing: border-box;"><a href="http://www.mycert.org.my/en/services/advisories/mycert/2014/main/detail/963/index.html" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">MyCERT (Malaysia)</a></li>
<li style="box-sizing: border-box;"><a href="http://www.cert.org.mx/boletin/?vulne=6487" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">UNAM-CERT (Mexico)</a></li>
<li style="box-sizing: border-box;"><a href="http://www.singcert.org.sg/alerts/21-latest/607-singcert-openssl-heartbleed-bug" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">SingCERT (Singapore)</a></li>
<li style="box-sizing: border-box;"><a href="http://www.qcert.org/sites/default/files/public/alert_details_9042014_heartbleed.pdf" style="background-position: 0px 0px; box-sizing: border-box; color: #428bca; text-decoration: none;">Q-CERT (Qatar)</a></li>
</ul>
</div>
</div>

The HeartBleed Bug

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the in...

19:59

Pacquiao, regains WBO Welterweight Title With Masterful Win Over Bradley

<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzAO3mB8OtkQFyPZeo9FyTRmtJbhtShim6kau5W2W-Mm19eu2tlM-HbKdNMSG5Pb3pHzRDLpRib9Spo9X8J1g6GziK_zajstPoM0hbmJ_9LxfgeXHfB-e4Q6Mc8PiF0EXxgOH1upk2SNEJ/s1600/whoooooooooo.png" /><br />
<span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"><br /></span>
<span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">The Pacman is back where he belongs.</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">Manny Pacquiao (56-5-2, 38 knockouts) regained the WBO welterweight title with a dominant unanimous decision victory over Timothy Bradley (32-1-0, 12 KOs). After a close fight in the opening rounds, Pacquiao showed that he is the superior fighter as he outlanded Bradley starting in the middle rounds.</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">After 12 rounds, the three judges scored it 118-110, 116-112, and 116-112 for Pacquiao.</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">The Filipino puncher, who last fought as a challenger against Miguel Cotto, stepped into the ring against a tenacious champion. Bradley showed early in the fight that he has the speed to give Pacquiao problems. The defending champion had his best moment in the fourth round when he buckled Pacquiao’s legs after landing a counter right reminiscent of Juan Manuel Marquez’ signature punch.</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">“He got me in the fourth round with a solid right hook but I listened to my corner: hands up, timing, counter him,” said Pacquiao after the fight. “I was very careful because his punches were all over.”</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">After having some success, Bradley quickly faded while Pacquiao gained momentum and sustained it with his top-class stamina. Pacquiao swept the middle rounds as Bradley was reduced to showboating. He stuck his tongue out at Pacquiao as he bobbed and weaved under some of the Pacman’s combinations but he did nothing to win rounds.</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">“I had to do more because he is much different from the first fight,” Pacquiao said of his opponent. “He improved a lot. There’s a time when I was looking for knockout but he’s tough, he moves around.”</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">“He’s the better fighter tonight, that’s what it is,” said Bradley who won the first fight eight rounds to four in his opinion. “I was trying to hit him over the top and land one on his chin,” he added explaining why his game plan was so different from their first fight.</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">Bradley abandoned his boxing and settled on throwing haymakers while Pacquiao expertly picked him apart from outside.</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">“I just have to go to the gym and get better,” said Bradley who suffered the first loss of his career. “But the war is not over. I want to be the best fighter in the world,” he ended, perhaps hinting that he wants a third match against Pacquiao</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">“We all wanted to see how the journeys of these two fighters after the fight two years ago. The winding ways that it went, the two devastating fights they went through,” Larry Merchant said to close the broadcast. “But what we saw now tells us we saw what we saw the first time.”</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">As for Manny Pacquiao, his statement remained simple.</span><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><br style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;" /><span style="background-color: white; color: #555555; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">“My journey in boxing will continue.”</span>

Pacquiao, regains WBO Welterweight Title With Masterful Win Over Bradley

The Pacman is back where he belongs. Manny Pacquiao (56-5-2, 38 knockouts) regained the WBO welterweight title with a dominant unanimous d...