Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.forth > #29535 > unrolled thread

Heartbleed detector

Back to article view | Back to comp.lang.forth

Contents

  Heartbleed detector Bernd Paysan <bernd.paysan@gmx.de> - 2014-04-11 20:35 +0200
    Re: Heartbleed detector Assad Ebrahim <assadebrahim2000@gmail.com> - 2014-04-11 11:56 -0700
      Re: Heartbleed detector Assad Ebrahim <assadebrahim2000@gmail.com> - 2014-04-11 12:02 -0700
        Re: Heartbleed detector "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-04-11 17:47 -0400
          Re: Heartbleed detector visualforth@rocketmail.com - 2014-04-11 15:42 -0700
    Re: Heartbleed detector visualforth@rocketmail.com - 2014-04-11 14:09 -0700
      Re: Heartbleed detector Bernd Paysan <bernd.paysan@gmx.de> - 2014-04-12 00:39 +0200
        Re: Heartbleed detector visualforth@rocketmail.com - 2014-04-11 15:50 -0700
          Re: Heartbleed detector Bernd Paysan <bernd.paysan@gmx.de> - 2014-04-12 15:16 +0200
            Re: Heartbleed detector visualforth@rocketmail.com - 2014-04-12 11:01 -0700
              Re: Heartbleed detector Bernd Paysan <bernd.paysan@gmx.de> - 2014-04-12 21:56 +0200

#29535 — Heartbleed detector

I've looked at several heartbleed detectors on the web, and they are all big 
bloatware, which don't show how simple and easy it is to use this weakness 
in SSL.  Therefore, I've written my own detector:

https://www.forth-ev.de/wiki/doku.php/examples:heartbleed

The essential thing you need to do on heartbleed is to send a Client hello 
and then a heartbeet with a very long payload length (16k in this example).

Unnecessary complication: I actually follow the TLS RFC when filling the 32 
bytes of randomness; since I'm not actually interested in a real SSL 
connection, I don't have to.  But that's a few lines of code.

When looking at the hex notation of the heartbeet request, it becomes 
immediately obvious that the payload length is redundant.  However, it also 
becomes obvious that SSL's protocol is not well structured, and this way of 
unstructured data makes it easy for stupid mistakes to sneak in.

Therefore: If someone tells me that this is the way you'd implant a backdoor 
on purpose, I'd say, the way SSL transfers data is paving that road.

An example for saner binary wrappers is protobuf, where you have a few data 
types, and you parse the protocol by reading tags and data with a few 
procedures made for that purpose - and those can be made safe.  Or net2o, 
which is essentially a postfix version of protobuf (instead of data tags you 
have postfix operations).

-- 
Bernd Paysan
"If you want it done right, you have to do it yourself"
http://bernd-paysan.de/

[toc] | [next] | [standalone]

#29536

On Friday, April 11, 2014 7:35:10 PM UTC+1, Bernd Paysan wrote:
> I've looked at several heartbleed detectors on the web, and they are all big 
> [...]
> The essential thing you need to do on heartbleed is to send a Client hello 
> and then a heartbeet with a very long payload length (16k in this example).
> 

Do you mean heart*beat* detector?  As in, a signal produced at regular intervals?

[toc] | [prev] | [next] | [standalone]

#29537

On Friday, April 11, 2014 7:56:01 PM UTC+1, Assad Ebrahim wrote:
> On Friday, April 11, 2014 7:35:10 PM UTC+1, Bernd Paysan wrote:
> 
> > I've looked at several heartbleed detectors on the web, and they are all big 
> 
> > [...]
> 
> > The essential thing you need to do on heartbleed is to send a Client hello 
> 
> > and then a heartbeet with a very long payload length (16k in this example).
> 
> > 
> 
> 
> 
> Do you mean heart*beat* detector?  As in, a signal produced at regular intervals?

Sorry -- that was a brain blockage.  You *do* mean heartbleed :)

http://xkcd.com/1354/

- Assad

[toc] | [prev] | [next] | [standalone]

#29545

On Fri, 11 Apr 2014 15:02:30 -0400, Assad Ebrahim  
<assadebrahim2000@gmail.com> wrote:
> On Friday, April 11, 2014 7:56:01 PM UTC+1, Assad Ebrahim wrote:
>> On Friday, April 11, 2014 7:35:10 PM UTC+1, Bernd Paysan wrote:

>> Do you mean heart*beat* detector?  As in, a signal produced at regular
>> intervals?

Yes.  He misspelled "heartbeat" as "heartbeet"(sic).

> Sorry -- that was a brain blockage.  You *do* mean heartbleed :)
>

He meant heartbleed.  That's the name of the security problem.


RP

[toc] | [prev] | [next] | [standalone]

#29548

On Friday, April 11, 2014 5:47:47 PM UTC-4, Rod Pemberton wrote:

> He meant heartbleed.  That's the name of the security problem.

I just got an email from Ipswitch with a link to more information:

http://heartbleed.com/

Fixed OpenSSL has been released to fix the problem:
OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable

Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
Source: https://www.openssl.org/news/secadv_20140407.txt

Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:

*Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
*Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
*CentOS 6.5, OpenSSL 1.0.1e-15
*Fedora 18, OpenSSL 1.0.1e-4
*OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
*FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
*NetBSD 5.0.2 (OpenSSL 1.0.1e)
*OpenSUSE 12.2 (OpenSSL 1.0.1c)

ForthOS is not on this list ;-)

[toc] | [prev] | [next] | [standalone]

#29544

On Friday, April 11, 2014 2:35:10 PM UTC-4, Bernd Paysan wrote:
> I've looked at several heartbleed detectors on the web, and they are all big 
> bloatware, which don't show how simple and easy it is to use this weakness 
> in SSL.  Therefore, I've written my own detector:
> 
> https://www.forth-ev.de/wiki/doku.php/examples:heartbleed
> 

http://www.forth-ev.de/wiki/doku.php/examples:heartbleed works better!
 
> "If you want it done right, you have to do it yourself"

[toc] | [prev] | [next] | [standalone]

#29547

visualforth@rocketmail.com wrote:

> On Friday, April 11, 2014 2:35:10 PM UTC-4, Bernd Paysan wrote:
>> I've looked at several heartbleed detectors on the web, and they are all
>> big bloatware, which don't show how simple and easy it is to use this
>> weakness
>> in SSL.  Therefore, I've written my own detector:
>> 
>> https://www.forth-ev.de/wiki/doku.php/examples:heartbleed
>> 
> 
> http://www.forth-ev.de/wiki/doku.php/examples:heartbleed works better!

No, you just need to trust CACert and import their root certificate in your 
browser, which has 600 untrustworthy root certificates, because they paid 
Netscape money (more than 10 years ago) to be included.

www.cacert.org/index.php?id=3

-- 
Bernd Paysan
"If you want it done right, you have to do it yourself"
http://bernd-paysan.de/

[toc] | [prev] | [next] | [standalone]

#29549

On Friday, April 11, 2014 6:39:18 PM UTC-4, Bernd Paysan wrote:

> > On Friday, April 11, 2014 2:35:10 PM UTC-4, Bernd Paysan wrote:
> >> https://www.forth-ev.de/wiki/doku.php/examples:heartbleed

> No, you just need to trust CACert and import their root certificate in your 
> browser, which has 600 untrustworthy root certificates, because they paid 
> Netscape money (more than 10 years ago) to be included.

You are right, that works, too.
I preferred the easier way -
because such a warning never showed up before when visiting www.forth-ev.de

[toc] | [prev] | [next] | [standalone]

#29568

visualforth@rocketmail.com wrote:

> On Friday, April 11, 2014 6:39:18 PM UTC-4, Bernd Paysan wrote:
> 
>> > On Friday, April 11, 2014 2:35:10 PM UTC-4, Bernd Paysan wrote:
>> >> https://www.forth-ev.de/wiki/doku.php/examples:heartbleed
> 
>> No, you just need to trust CACert and import their root certificate in
>> your browser, which has 600 untrustworthy root certificates, because they
>> paid Netscape money (more than 10 years ago) to be included.
> 
> You are right, that works, too.
> I preferred the easier way -
> because such a warning never showed up before when visiting
> www.forth-ev.de

Yes, that's the problem why security doesn't work: Instead of doing 
something, you preferred to not use security at all.

-- 
Bernd Paysan
"If you want it done right, you have to do it yourself"
http://bernd-paysan.de/

[toc] | [prev] | [next] | [standalone]

#29581

On Saturday, April 12, 2014 9:16:47 AM UTC-4, Bernd Paysan wrote:
> 
> Yes, that's the problem why security doesn't work: Instead of doing 
> something, you preferred to not use security at all.

No, I prefer built in security. Systems have to be secure in the first place.

[toc] | [prev] | [next] | [standalone]

#29588

visualforth@rocketmail.com wrote:

> On Saturday, April 12, 2014 9:16:47 AM UTC-4, Bernd Paysan wrote:
>> 
>> Yes, that's the problem why security doesn't work: Instead of doing
>> something, you preferred to not use security at all.
> 
> No, I prefer built in security. Systems have to be secure in the first
> place.

Yes, agreed.  But on the current internet you don't have that.

-- 
Bernd Paysan
"If you want it done right, you have to do it yourself"
http://bernd-paysan.de/

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.forth

csiph-web