heartbleed bug

[engineergurl]

http://www.businessinsider.com/heartbleed-bug-explainer-2014-4

The flaw was first reported to the team behind OpenSSL by Google security researcher Neel Mehta, and independently found by security firm Codenomicon. According to the researchers who discovered the flaw, the code has been in OpenSSL for about two years, and using it doesn't leave a trace.

Read more: http://www.businessinsider.com/heartbleed-bug-explainer-2014-4#ixzz2yPYAtUhW

 

[NJmike PE]

not even cool. this link has a virus attached.

EDIT: My desktop scanner went off

 

[knight1fox3]

It would appear the funny man from NJ has returned. No detrimental effects that I can see.

 

[NJmike PE]

I don't know. I was serious. I'm running Malwarebytes. I def got a notification

 

[engineergurl]

Thank you KF... there were no big "STOP- DON'T CLICK THAT" on my computer either but I appreciate you checking for me

 

[YMZ PE]

We're giving it a few days before we change our passwords. I always find these things fascinating, how a single line of code can have one parameter changed and result in serious unintended consequences.

 

[knight1fox3]

I don't know. I was serious. I'm running Malwarebytes. I def got a notification

Seems consequential to me. What kind of sites do you look at on your lunch break anyway? hmy:

And I don't see how changing on online password is going to alleviate the issue. It's still an online password. LOL

 

[NJmike PE]

I don't know. I was serious. I'm running Malwarebytes. I def got a notification

Seems consequential to me. What kind of sites do you look at on your lunch break anyway? hmy:

And I don't see how changing on online password is going to alleviate the issue. It's still an online password. LOL

EB.com and fb

 

[YMZ PE]

And I don't see how changing on online password is going to alleviate the issue. It's still an online password. LOL

It's not going to alleviate the issue; the servers running OpenSSL will fix the code on their end. This is just to protect against any unknown prior exploitation of this bug. I don't think that's a stupid line of reasoning so please don't LOL at silly me.

 

[engineergurl]

And I don't see how changing on online password is going to alleviate the issue. It's still an online password. LOL

It's not going to alleviate the issue; the servers running OpenSSL will fix the code on their end. This is just to protect against any unknown prior exploitation of this bug. I don't think that's a stupid line of reasoning so please don't LOL at silly me.

I came to the same conclusion...

...then again, I forget my passwords so often, I'm usually changing them every time I log on, so chances are if someone got my password previously, it's already been changed

 

[knight1fox3]

And I don't see how changing an online password is going to alleviate the issue. It's still an online password. LOL

It's not going to alleviate the issue; the servers running OpenSSL will fix the code on their end. This is just to protect against any unknown prior exploitation of this bug. I don't think that's a stupid line of reasoning so please don't LOL at silly me.

I by no means was LOL'ing at you. If you read the comments section, that's what they're telling people to do. I was LOL'ing at their resolve. I would go the encryption/firewall route more over just simply changing a password. Now get me a cookie!

 

[knight1fox3]

I don't know. I was serious. I'm running Malwarebytes. I def got a notification

Seems consequential to me. What kind of sites do you look at on your lunch break anyway? hmy:

And I don't see how changing on online password is going to alleviate the issue. It's still an online password. LOL

.....and fb

Which has TONS of external links to other malware ridden sites and games.

 

[NJmike PE]

.....and fb

Which has TONS of external links to other malware ridden sites and games.

I agree. However I got the notification while working. I open EGs link, boss came over so I minimized. Boss walked away and then I got the notification.

 

[engineergurl]

And I don't see how changing an online password is going to alleviate the issue. It's still an online password. LOL

It's not going to alleviate the issue; the servers running OpenSSL will fix the code on their end. This is just to protect against any unknown prior exploitation of this bug. I don't think that's a stupid line of reasoning so please don't LOL at silly me.

I by no means was LOL'ing at you. If you read the comments section, that's what they're telling people to do. I was LOL'ing at their resolve. I would go the encryption/firewall route more over just simply changing a password. Now get me a cookie!

is this the thing we have to stick our cards into in order to get on any of the Army websites at home with

 

[knight1fox3]

Yes that is one form of encryption, but that would be a bit extreme in my opinion. 2-step authentication would probably be a better, easier alternative to implement.

 

[knight1fox3]

.....and fb

Which has TONS of external links to other malware ridden sites and games.

I agree. However I got the notification while working. I open EGs link, boss came over so I minimized. Boss walked away and then I got the notification.

Well either way, the MBAM log file (scan or probably activity) should contain info on where the malware originated. If you wanted to know for certain.

 

[knight1fox3]

This seems to be the most solid remedy I've seen yet:

Some of our infrastructure uses custom-compiled Nginx, which utilized the flawed OpenSSL library. Other services use the binaries provided by the OS (for example, CentOS or Ubuntu). That fixed the critical issue of random-bits being displayed to an attacking user, which could then be used to steal session information or reveal our private certificate from which we encrypt SSL traffic. In theory, that means if someone has that certificate and has collected our traffic, they could decrypt it to see what was transmitted. This is an unlikely situation, but due to the length of time this bug was active within OpenSSL, it is a concern (especially considering the latest revelations of mass data surveillance.)

 

[engineergurl]

This seems to be the most solid remedy I've seen yet:

Some of our infrastructure uses custom-compiled Nginx, which utilized the flawed OpenSSL library. Other services use the binaries provided by the OS (for example, CentOS or Ubuntu). That fixed the critical issue of random-bits being displayed to an attacking user, which could then be used to steal session information or reveal our private certificate from which we encrypt SSL traffic. In theory, that means if someone has that certificate and has collected our traffic, they could decrypt it to see what was transmitted. This is an unlikely situation, but due to the length of time this bug was active within OpenSSL, it is a concern (especially considering the latest revelations of mass data surveillance.)

That isn't a remedy, that is just an explanation... and it tells me that even if I were encrypting it in addition to THEIR encryption stuff, since the hacker dude has the certificate, it can all be decrypted because technically it has reached the intended recipient (or thinks it has)... The quote makes absolutely no sense. I think it's computer geeks thinking they are smart and trying to fool everyone, not realizing that in spite of the lack of terminology usage, we aren't dumb....

 

[knight1fox3]

I believe you missed the facts here sweet cheeks. It IS a remedy.

Infrastructures need to start migrating from the Nginx system that uses OpenSSL. There are 2 (among others) systems that use different binaries where they would be immune to this exploit (i.e. CentOS or Ubuntu). Further protection measures would include firewalls and encryption.

The REALLY smart computer geeks, do not give explanations like this to the general public. LOL They just implement their solution and don't talk about it when everyone learns the problem has been fixed. :thumbs:

 

[blybrook PE]

CNN finally posted a decent article on what sites have been repaired, etc...

http://money.cnn.com/2014/04/10/technology/security/heartbleed-passwords/index.html?hpt=hp_t2

So it looks like gmail, facebook, yahoo and some dating site were hit the hardest. Am sure there are several others out there waiting to be completed.