Amiga.org
Amiga computer related discussion => General chat about Amiga topics => Topic started by: mpiva on April 10, 2014, 12:33:29 AM
-
I've just been reading up on the Heartbleed security flaw in OpenSSL. Pretty scary stuff. I was wondering if Amigoid OS's are vulnerable to this flaw?
http://www.heavy.com/tech/2014/04/heartbleed-security-flaw/ (http:// http://www.heavy.com/tech/2014/04/heartbleed-security-flaw/)
-
I'd say there's a good chance we're vulnerable. On the other hand, our versions of OpenSSL are rather old and might pre-date the introduction of the bug.
I heard on the radio this morning that a Finnish web security firm was instrumental in discovering this. I wonder if our man Piru played a role :)
-
This weeks Security Now podcast was all about Heartbleed - a must watch for anyone interested in security as a whole or Heartbleed specifically.
http://twit.tv/show/security-now/450
-
I've just been reading up on the Heartbleed security flaw in OpenSSL. Pretty scary stuff. I was wondering if Amigoid OS's are vulnerable to this flaw?
http://www.heavy.com/tech/2014/04/heartbleed-security-flaw/ (http:// http://www.heavy.com/tech/2014/04/heartbleed-security-flaw/)
My understanding is that this is a flaw on the server side. How many people are running a web server with OpenSSL on their AmigaOS/Amiga-compatible-OS let alone with a version of OpenSSL with that bug?
Hans
-
It depends on the version of OpenSSL and yes ANY device may be in danger.
And no. It is not only a server side problem. If OWB is using the broken SSL port, which is possible with the OS4 Port of V1.23, and accessing a compromised server, the server can read out 64KB of memory on your computer, which for sure contains plain keys. MorphOS OSB V1.23 at least is safe. You need to ask Kas1e what version is used in his port.
Even if it is a known site with already got updated, you do not know if it was compromised before and still spys on you.
Same for any application using SSL. Check the versions used.
You need to update or any kind of server (mail, https, ...) may spy on you.
Geit
-
The versions in question that are vulnerable are versions 1.0.0 - 1.0.1f (they fixed it in 1.0.1g). So if you're running Debian Squeeze, or something older that is using 0.9.8* then you're safe from heartbleed.
I am running something newer, and have already patched my stuff, fortunately I only had a few servers that needed it. Reissuing SSL keys is annoying as well, but I did that.
slaapliedje
-
As Slaap said, it's very important that the general end user understands where the issue with Heartbleed lies.
It is solely dependent on having the "broken" versions of OpenSSL installed and operational on server side. You're not going to find an OS patch to fix this on your respective user grade operating systems, the problem lies with what version of OpenSSL any respective server uses.
I'd hope that a good number of hosts have been patched by now, but I know better than to assume it :)
-
It also has to do with whether or not the service in question uses a heartbeat. So things like Apache are vulnerable, but OpenSSH is not. At least from what I've been reading. So yeah, clients wouldn't really be affected. I wouldn't be 100% sure about that, but I can be fairly certain that OpenSSL for the Amiga shouldn't be affected, I don't think it's been updated in quite some time.
slaapliedje
-
As I said earlier: Clients can indeed be vulnerable.
Major browsers are not (ie, chrome, ff, safari, opera), but Curl, Links and some other client software may be the only reason this isn't a major disaster clientwise is due to the browsers already being secure.
The "heartbeat" protocol works both ways. Both client and server can initiate the heartbeat, so evil server could read clients memory if the client is vulnerable. Of course you need to get the client to visit your site
(Piru via IRC)
-
Just noticed this on OS4Depot today:
libopenssl.lha (http://www.os4depot.net/?function=showfile&file=development/library/misc/libopenssl.lha) dev/lib/mis 1.0.1g 10Mb 10 Apr 14 4.0 8 ¤ Libopenssl - The Open Source toolkit for SSL/TLS
2014-04-10 - Updated to 1.0.1g.
-
Just noticed this on OS4Depot today:
libopenssl.lha (http://www.os4depot.net/?function=showfile&file=development/library/misc/libopenssl.lha) dev/lib/mis 1.0.1g 10Mb 10 Apr 14 4.0 8 ¤ Libopenssl - The Open Source toolkit for SSL/TLS
2014-04-10 - Updated to 1.0.1g.
Doh. And the security experts say you should be on the latest versions..... It they were behind the times they would have been safe.
Don't let Commodore John get wind of this...;)
-
Don't worry, John still does all his internet communications via tin cans connected with strings and smoke signals :)
Just giving you a hard time, John :)