Welcome, Guest. Please login or register.
Forums
« previous next »
Pages: [1]   Go Down

Author Topic: Heartbleed  (Read 2738 times)

Description:

0 Members and 1 Guest are viewing this topic.

Offline mpivaTopic starter

  • Sr. Member
  • ****
  • Join Date: Aug 2003
  • Posts: 297
    • Show only replies by mpiva
    • http://members.shaw.ca/michpiva
Heartbleed
« on: April 10, 2014, 12:33:29 AM »
I've just been reading up on the Heartbleed security flaw in OpenSSL. Pretty scary stuff. I was wondering if Amigoid OS's are vulnerable to this flaw?

http://www.heavy.com/tech/2014/04/heartbleed-security-flaw/
Logged
-- Michael A. Piva --


"In engineering, there is no single truth, no one right answer; there\'s a canvas, and you paint it your way, only with chips or gates or subroutines rather than actual paint. That\'s the Amiga..."
-Dave Haynie
 

Offline Matt_H

Re: Heartbleed
« Reply #1 on: April 10, 2014, 01:08:28 AM »
I'd say there's a good chance we're vulnerable. On the other hand, our versions of OpenSSL are rather old and might pre-date the introduction of the bug.

I heard on the radio this morning that a Finnish web security firm was instrumental in discovering this. I wonder if our man Piru played a role :)
Logged
 

Offline Duce

  • Off to greener pastures
  • Hero Member
  • *****
  • Join Date: Jul 2009
  • Posts: 1699
    • Show only replies by Duce
    • http://amigabbs.blogspot.com/
Re: Heartbleed
« Reply #2 on: April 10, 2014, 01:53:17 AM »
This weeks Security Now podcast was all about Heartbleed - a must watch for anyone interested in security as a whole or Heartbleed specifically.

http://twit.tv/show/security-now/450
Logged
 

Offline Hans_

Re: Heartbleed
« Reply #3 on: April 10, 2014, 02:28:40 AM »
Quote from: mpiva;762267
I've just been reading up on the Heartbleed security flaw in OpenSSL. Pretty scary stuff. I was wondering if Amigoid OS's are vulnerable to this flaw?

http://www.heavy.com/tech/2014/04/heartbleed-security-flaw/


My understanding is that this is a flaw on the server side. How many people are running a web server with OpenSSL on their AmigaOS/Amiga-compatible-OS let alone with a version of OpenSSL with that bug?

Hans
Logged
Join the Kea Campus - upgrade your skills; support my work; enjoy the Amiga corner.
https://keasigmadelta.com/ - see more of my work
 

Offline Geit

  • Newbie
  • *
  • Join Date: Dec 2009
  • Posts: 34
    • Show only replies by Geit
Re: Heartbleed
« Reply #4 on: April 10, 2014, 11:42:13 AM »
It depends on the version of OpenSSL and yes ANY device may be in danger.

And no. It is not only a server side problem. If OWB is using the broken SSL port, which is possible with the OS4 Port of V1.23, and accessing a compromised server, the server can read out 64KB of memory on your computer, which for sure contains plain keys. MorphOS OSB V1.23 at least is safe. You need to ask Kas1e what version is used in his port.

Even if it is a known site with already got updated, you do not know if it was compromised before and still spys on you.

Same for any application using SSL. Check the versions used.

You need to update or any kind of server (mail, https, ...) may spy on you.

 Geit
« Last Edit: April 10, 2014, 12:54:15 PM by Geit »
Logged
 

Offline slaapliedje

  • Lifetime Member
  • Hero Member
  • *****
  • Join Date: Oct 2010
  • Posts: 843
  • Country: 00
  • Thanked: 1 times
    • Show only replies by slaapliedje
Re: Heartbleed
« Reply #5 on: April 10, 2014, 02:20:25 PM »
The versions in question that are vulnerable are versions 1.0.0 - 1.0.1f (they fixed it in 1.0.1g).  So if you're running Debian Squeeze, or something older that is using 0.9.8* then you're safe from heartbleed.  

I am running something newer, and have already patched my stuff, fortunately I only had a few servers that needed it.  Reissuing SSL keys is annoying as well, but I did that.

slaapliedje
Logged
A4000D: Mediator 4000Di; Voodoo 3, ZorRAM 128MB, 10/100mb Ethernet, Spider 2. Cyberstorm PPC 060/50 604e/420.
 

Offline Duce

  • Off to greener pastures
  • Hero Member
  • *****
  • Join Date: Jul 2009
  • Posts: 1699
    • Show only replies by Duce
    • http://amigabbs.blogspot.com/
Re: Heartbleed
« Reply #6 on: April 10, 2014, 02:53:25 PM »
As Slaap said, it's very important that the general end user understands where the issue with Heartbleed lies.

It is solely dependent on having the "broken" versions of OpenSSL installed and operational on server side.  You're not going to find an OS patch to fix this on your respective user grade operating systems, the problem lies with what version of OpenSSL any respective server uses.

I'd hope that a good number of hosts have been patched by now, but I know better than to assume it :)
Logged
 

Offline slaapliedje

  • Lifetime Member
  • Hero Member
  • *****
  • Join Date: Oct 2010
  • Posts: 843
  • Country: 00
  • Thanked: 1 times
    • Show only replies by slaapliedje
Re: Heartbleed
« Reply #7 on: April 10, 2014, 02:57:41 PM »
It also has to do with whether or not the service in question uses a heartbeat.  So things like Apache are vulnerable, but OpenSSH is not.  At least from what I've been reading.  So yeah, clients wouldn't really be affected.  I wouldn't be 100% sure about that, but I can be fairly certain that OpenSSL for the Amiga shouldn't be affected, I don't think it's been updated in quite some time.

slaapliedje
Logged
A4000D: Mediator 4000Di; Voodoo 3, ZorRAM 128MB, 10/100mb Ethernet, Spider 2. Cyberstorm PPC 060/50 604e/420.
 

Offline Geit

  • Newbie
  • *
  • Join Date: Dec 2009
  • Posts: 34
    • Show only replies by Geit
Re: Heartbleed
« Reply #8 on: April 10, 2014, 06:03:44 PM »
As I said earlier: Clients can indeed be vulnerable.

Major browsers are not (ie, chrome, ff, safari, opera), but Curl, Links and some other client software may be the only reason this isn't a major disaster clientwise is due to the browsers already being secure.

The "heartbeat" protocol works both ways. Both client and server can initiate the heartbeat, so evil server could read clients memory if the client is vulnerable. Of course you need to get the client to visit your site

(Piru via IRC)
« Last Edit: April 10, 2014, 06:07:03 PM by Geit »
Logged
 

Offline mpivaTopic starter

  • Sr. Member
  • ****
  • Join Date: Aug 2003
  • Posts: 297
    • Show only replies by mpiva
    • http://members.shaw.ca/michpiva
Re: Heartbleed
« Reply #9 on: April 10, 2014, 11:18:49 PM »
Just noticed this on OS4Depot today:


libopenssl.lha   dev/lib/mis   1.0.1g   10Mb   10 Apr 14   4.0   8   ¤ Libopenssl - The Open Source toolkit for SSL/TLS

2014-04-10 - Updated to 1.0.1g.
Logged
-- Michael A. Piva --


"In engineering, there is no single truth, no one right answer; there\'s a canvas, and you paint it your way, only with chips or gates or subroutines rather than actual paint. That\'s the Amiga..."
-Dave Haynie
 

Offline gertsy

  • Lifetime Member
  • Hero Member
  • *****
  • Join Date: May 2006
  • Posts: 2318
  • Country: au
  • Thanked: 1 times
    • Show only replies by gertsy
    • http://www.members.optusnet.com.au/~gbakker64/
Re: Heartbleed
« Reply #10 on: April 11, 2014, 07:08:12 AM »
Quote from: mpiva;762317
Just noticed this on OS4Depot today:


libopenssl.lha   dev/lib/mis   1.0.1g   10Mb   10 Apr 14   4.0   8   ¤ Libopenssl - The Open Source toolkit for SSL/TLS

2014-04-10 - Updated to 1.0.1g.


Doh.  And the security experts say you should be on the latest versions..... It they were behind the times they would have been safe.
Don't let Commodore John get wind of this...;)
Logged
 

Offline Duce

  • Off to greener pastures
  • Hero Member
  • *****
  • Join Date: Jul 2009
  • Posts: 1699
    • Show only replies by Duce
    • http://amigabbs.blogspot.com/
Re: Heartbleed
« Reply #11 on: April 11, 2014, 09:03:01 AM »
Don't worry, John still does all his internet communications via tin cans connected with strings and smoke signals  :)

Just giving you a hard time, John :)
Logged
 
Pages: [1]   Go Up
« previous next »