Heartbleed Bug - This doesn't look good

[Rayspcsolutions]

So this doesn't look good and it looks like it is not an easy one to fix, although some of the big name sites have already made the necessary patches to their servers.

Read about it here: http://www.businessinsider.com/heartbleed-bug-explainer-2014-4

 

[GCS]

Test a site: https://lastpass.com/heartbleed/

 

[jft135]

I'm glad that I don't actually use the SSL on my site for anything important at the moment.

 

[Galdorf]

Over 500 million websites are effected the NSA has been using this bug to snoop on people.

 

[Bubbajoe]

.... the NSA has been using this bug to snoop on people.

^^^^Pure speculation....

 

[nlinecomputers]

Over 500 million websites are effected the NSA has been using this bug to snoop on people.

^^^^Pure speculation....

Yep. Because for the NSA to have done that requires two events. One that they have been recording encrypted web traffic (which is a given as they have admitted as much) AND that they have used this exploit to attack servers and retrieve the private SSL keys. That is unlikely unless you think that NSA was aware of this exploit before it was discovered Monday. Possible but I doubt it. And there is some dispute about IF a Private key CAN be retrieved in this way. Without the private keys what they have recorded is not going to be accessible.

 

[GCS]

NSA or not.. SSL is broken as all hell.

It's useless if the attacker knows what he's doing.

http://www.thoughtcrime.org/software/sslstrip/
http://www.thoughtcrime.org/software/sslsniff/

Those are just two simple examples of open source/free software that exploits SSL.

 

[Galdorf]

what is even scarier is the CRA the equiv of IRS was using OpenSSL all sites are now closed and they are fixing atm that means no EFiling taxes.

 

[AtYourService]

 

[Rocco]

I am confused. How did the NSA get involved in this???

 

[SilverLeaf]

Gotta love xkcd! Excellent distillation of how it works.

http://xkcd.com/1354/

 

[Galdorf]

I am confused. How did the NSA get involved in this???

NSA Exploited Heartbleed For Years

 

[jft135]

Well, Hostgator just patched my VPS. Took me out of commission for 1/2 during the busiest time of the day, but I'm happy it's fixed now.

 

[Bubbajoe]

NSA Exploited Heartbleed For Years

Wow, some people will believe anything they read.

Bloomberg offered zero proof. It's all hype, some reporter trying to make a name for himself.

And NSA has officially denied Bloomberg's claims:

https://twitter.com/nsa_pao/status/454720059156754434

 

[Rocco]

NSA Exploited Heartbleed For Years

I grow purple grass in my greenhouse that has the same effect as Viagra!

It is true, because I just said it. I don't need to provide proof, it is true, because I just said it. I don't need sources, it is true, because I just said it.

That link is a joke, and completely made up, just like my first sentence was. It has the same amount of logic and proof in it as my second through fourth sentences had.

 

[bertie40]

I grow purple grass in my greenhouse that has the same effect as Viagra! .......

Wow, stiff opposition

Whether it's true or not is no longer relevant.

The general public has been alerted to this new "problem" and it puts computer techs in a bad light if we can't explain this "flaw" upon being asked .... whilst out on the job

 

[Rocco]

Wow, stiff opposition

Whether it's true or not is no longer relevant.

The general public has been alerted to this new "problem" and it puts computer techs in a bad light if we can't explain this "flaw" upon being asked .... whilst out on the job

Yes, learn about Heartbleed. Blog about it's affects. Tell them about how the websites you do business with (ie Carbonite) are safe, and not affected and never were, or if they were, how they are patched now. Recommend finding out if a website was vulnerable, and if it no longer is, changing the password. Know the bug.

However, if I was talking to a customer about the bug, and they tell me that the NSA took advantage of it for the last 2 years, then they showed me that link, or the Bloomberg story attached to it, I would have been hardpressed not to laugh in their face. I won't give any credibility to a story that some guy wrote online, without any basis. And I certainly won't spread the story to my customers.

Now that I know about this sillyness, I may not laugh in their face, so I guess it was good to read on here. I may not. Maybe. But I would have a big laugh as soon as I got in my car.

 

[Galdorf]

Yes, learn about Heartbleed. Blog about it's affects. Tell them about how the websites you do business with (ie Carbonite) are safe, and not affected and never were, or if they were, how they are patched now. Recommend finding out if a website was vulnerable, and if it no longer is, changing the password. Know the bug.

However, if I was talking to a customer about the bug, and they tell me that the NSA took advantage of it for the last 2 years, then they showed me that link, or the Bloomberg story attached to it, I would have been hardpressed not to laugh in their face. I won't give any credibility to a story that some guy wrote online, without any basis. And I certainly won't spread the story to my customers.

Now that I know about this sillyness, I may not laugh in their face, so I guess it was good to read on here. I may not. Maybe. But I would have a big laugh as soon as I got in my car.

How about Edward Snowden would you believe him?
how about Reuters?


New Snowden documents say NSA can break common Internet encryption

 

[NYJimbo]

We patched our Linux hosting servers in 10 minutes and our IIS servers don't have openSSL.

Next bug please......

 

[Bubbajoe]

We patched our Linux hosting servers in 10 minutes and our IIS servers don't have openSSL.

Next bug please......

Agreed, the fix is quick and easy.