Hashbang.ca

Pages

  • Privacy Policy
  • About the author

Posts

  • Book review: Site Reliability Engineering
  • Diagnosing performance degradation under adverse circumstances
  • CSRF vulnerability at CloudAtCost.com
  • Legal issues in computer security research
  • Recovering from Heartbleed
  • Mike will be a Googler
  • Upgrading encrypted Android devices
  • Exploring Canada's computer crime laws: Part 3
  • Exploring Canada's computer crime laws: Part 2
  • Exploring Canada's computer crime laws: Part 1
  • How to run a question period
  • Validating SSL certificates for IRC bouncers
  • Introducing Hack::Natas
  • Presenting my Natas solutions at NSLUG
  • SSL configuration on nginx
  • Server-side security war games: Part 16
  • Server-side security war games: Part 15
  • Server-side security war games: Part 14
  • Server-side security war games: Part 13
  • Server-side security war games: Part 12

Tags

acme activemq advocacy agile android apache atlseccon bash bdfoy biella book-review bug busybox c-11 canada cfaa chromatic cli co-op coding-freedom conference copyright corba cpan crime crypto csp csrf curl cyanogenmod dagolden dal dancer dbix-class debian deployment design dhcp docs doy drdc drm dzil font foss gedit git google hacking hci heartbleed ide incident infosec ingy irc jacinta jamesgannon java journalism kentnl lawful-access leagueofmovabletype leont linux luks lvm lwp marketing memcached mgeist miyagawa mmims mock mod_perl modern-perl module-build moose movabletype mst natas nginx nickdepetrillo noose nslug obra oo p5p patch path-tiny performance perl perl5i php plack politics prepan psych pythian quinnorton regex release rjbs roadmap rolsky rwstauner schwern scm sf spying sql sre ssl survillance talks techpolicy testing thanks tls twitter typography ui unicode updated utf8 vuln wall waterfall wifi windows wordpress xss yanick yapc youtube

Links

  • Twitter
  • Instagram
  • Github
  • LinkedIn
  • CPAN
  • keybase.io

Customise

  • White
  • Black
  • Blue
  • Green
  • Grey

Recovering from Heartbleed

Heartbleed is a critical vulnerability in OpenSSL revealed yesterday. I’m not sure it could be more serious: it allows an attacker to connect to your server and use the TLS heartbeat extension to obtain 64k of server memory (and do it again to get another 64k and again and…) – while leaving no traces in logs. That server memory might include primary key material (private keys), secondary key material (usernames and passwords), and collateral (memory addresses, canaries used to detect overflow, etc)

Read More...
Permanent link for post: /post/recovering-from-heartbleed/
Posted: Apr 8, 2014
Tags: heartbleed  infosec  ssl  updated 

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License .