Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.forth > #29535

Heartbleed detector

Show all headers | View raw

I've looked at several heartbleed detectors on the web, and they are all big 
bloatware, which don't show how simple and easy it is to use this weakness 
in SSL.  Therefore, I've written my own detector:

https://www.forth-ev.de/wiki/doku.php/examples:heartbleed

The essential thing you need to do on heartbleed is to send a Client hello 
and then a heartbeet with a very long payload length (16k in this example).

Unnecessary complication: I actually follow the TLS RFC when filling the 32 
bytes of randomness; since I'm not actually interested in a real SSL 
connection, I don't have to.  But that's a few lines of code.

When looking at the hex notation of the heartbeet request, it becomes 
immediately obvious that the payload length is redundant.  However, it also 
becomes obvious that SSL's protocol is not well structured, and this way of 
unstructured data makes it easy for stupid mistakes to sneak in.

Therefore: If someone tells me that this is the way you'd implant a backdoor 
on purpose, I'd say, the way SSL transfers data is paving that road.

An example for saner binary wrappers is protobuf, where you have a few data 
types, and you parse the protocol by reading tags and data with a few 
procedures made for that purpose - and those can be made safe.  Or net2o, 
which is essentially a postfix version of protobuf (instead of data tags you 
have postfix operations).

-- 
Bernd Paysan
"If you want it done right, you have to do it yourself"
http://bernd-paysan.de/

Back to comp.lang.forth | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Heartbleed detector Bernd Paysan <bernd.paysan@gmx.de> - 2014-04-11 20:35 +0200
  Re: Heartbleed detector Assad Ebrahim <assadebrahim2000@gmail.com> - 2014-04-11 11:56 -0700
    Re: Heartbleed detector Assad Ebrahim <assadebrahim2000@gmail.com> - 2014-04-11 12:02 -0700
      Re: Heartbleed detector "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-04-11 17:47 -0400
        Re: Heartbleed detector visualforth@rocketmail.com - 2014-04-11 15:42 -0700
  Re: Heartbleed detector visualforth@rocketmail.com - 2014-04-11 14:09 -0700
    Re: Heartbleed detector Bernd Paysan <bernd.paysan@gmx.de> - 2014-04-12 00:39 +0200
      Re: Heartbleed detector visualforth@rocketmail.com - 2014-04-11 15:50 -0700
        Re: Heartbleed detector Bernd Paysan <bernd.paysan@gmx.de> - 2014-04-12 15:16 +0200
          Re: Heartbleed detector visualforth@rocketmail.com - 2014-04-12 11:01 -0700
            Re: Heartbleed detector Bernd Paysan <bernd.paysan@gmx.de> - 2014-04-12 21:56 +0200

csiph-web