Re: heartbleed OpenSSL bug CVE-2014-0160

[Paul Vixie <paul () redbarn org>]

Juergen Christoffel wrote:
> On Thu, Apr 10, 2014 at 11:32:21PM -0700, Paul Vixie wrote:
> > [...]
> > really bruce? on a scale of doesn't-matter-at-all to
> > worst-thing-you-could-have-previously-imagined, a read only exploit is
> > even worse than that?
>
> With all due respect to your ego Paul, I think you might
> under-estimate the
> long term effects: private keys get stolen, this allows people to play
> man-in-the-middle, people (the masses) will renew their certificates but
> might re-use their generated private keys because the don't know exactly
> what they are doing, etc.

thanks for whatever respect may be due, but bruce is still wrong. the
cost to fix this is:

1. replace all private keys
2. replace all passwords
3. upgrade all SSL software

that rates 9 out of 10, where 10 is the worst thing i could have
imagined pre-heartbleed, which is remote file modification and/or remote
code execution, because the costs in that case would be:

1. inclusive of [1..3] above
2. replace all operating systems
3. audit or replace all user data

> As the EFF's traces back into 2013 might tell us, some bad guys exploited
> this for some time now. If this is the case, we might soon arrive at the
> conclusion that we need to exchange all certificates which had been
> created
> in the last two years.

we already have to do that, since we have to assume the worst whenever
we don't have log files which somehow prove a negative.

> While I hope it tends to your interpretation, I fear a bit that it
> might be
> Bruces in the long run.

bruce was spouting nonsense. heartbleed's costs will not be higher than
previously imaginable.

vixie

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/