Full Disclosure mailing list archives
Re: heartbleed OpenSSL bug CVE-2014-0160
From: Joerg Mertin <smurphy () solsys org>
Date: Fri, 11 Apr 2014 21:52:51 +0200
When I first heard it, I suspected that there was something more behind it. Thing is - as secret services are not able to actually brute-force encryption, they needed to find a way around. And the only one way around was to either use existing bugs/weaknesses, or implant some (as NIST). http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html Don't you guys feel that in the last 12 months, there are very many bugs related to SSL showing up ? IMHO that is not a coincidence... these are too many for me to believe this is coincidence. I really believe that some secret service agencies have made sure that certain weaknesses are implanted or if discovered, remain where they are (in the dark) so they can actually use these if required. The best about that is the media coverage. I have rarely (except when I hear politicians talk) heard so much junk in so short sentences. On Tuesday 08 April 2014 03:10:06 Kirils Solovjovs wrote:
We are doomed. Description: http://www.openssl.org/news/vulnerabilities.html Article dedicated to the bug: http://heartbleed.com/ Tool to check if TLS heartbeat extension is supported: http://possible.lv/tools/hb/ A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server. 1.0.1[ abcdef] affected.
-- You can no more win a war than you can win an earthquake. -- Jeannette Rankin ------------------------------------------------------------------------ Joerg Mertin in Clermont/France Web: http://www.solsys.org PGP: Public Key Server - Get "0x159DC660F946126F" _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Re: heartbleed OpenSSL bug CVE-2014-0160, (continued)
- Re: heartbleed OpenSSL bug CVE-2014-0160 Michal Zalewski (Apr 11)
- Re: heartbleed OpenSSL bug CVE-2014-0160 Ferenc Kovacs (Apr 11)
- Re: heartbleed OpenSSL bug CVE-2014-0160 Manuel Tiago Pereira (Apr 11)
- Re: heartbleed OpenSSL bug CVE-2014-0160 Schmidt, Michael (Apr 11)
- Re: heartbleed OpenSSL bug CVE-2014-0160 Afonso Araújo Neto (Apr 11)
- Message not available
- Re: heartbleed OpenSSL bug CVE-2014-0160 Ricardo Iramar dos Santos (Apr 11)
- Re: heartbleed OpenSSL bug CVE-2014-0160 HaCKsPy (Apr 11)
- Andrew "Weev" Auernheimer's Conviction Thrown Out g () 1337 io (Apr 11)
- Re: Andrew "Weev" Auernheimer's Conviction Thrown Out Jeffrey Paul (Apr 11)
- Re: Andrew "Weev" Auernheimer's Conviction Thrown Out Groundworks Technologies Advisories (Apr 11)
- Re: heartbleed OpenSSL bug CVE-2014-0160 Michal Zalewski (Apr 11)