Jump to content

Heartbleed

From Wikipedia, the free encyclopedia
For other uses, seeHeartbleed (disambiguation).

Heartbleed
Logo representing Heartbleed. Awareness and media coverage of Heartbleed was unusually high for a software bug.[1][2]
CVE identifier(s)CVE-2014-0160
Released1 February 2012;12 years ago(2012-02-01)
Date discovered1 April 2014;10 years ago(2014-04-01)
Date patched7 April 2014;10 years ago(2014-04-07)
Discoverer
Affected softwareOpenSSL(1.0.1)
Websiteheartbleed

Heartbleedis asecurity bugin some outdated versions of theOpenSSLcryptographylibrary, which is a widely used implementation of theTransport Layer Security(TLS) protocol. It was introduced into the software in 2012 and publicly disclosed in April 2014. Heartbleed could be exploited regardless of whether the vulnerable OpenSSL instance is running as a TLS server or client. It resulted from improper input validation (due to a missingbounds check) in the implementation of the TLSheartbeatextension.[5]Thus, the bug's name derived fromheartbeat.[6]The vulnerability was classified as abuffer over-read,[7]a situation where more data can be read than should be allowed.[8]

Heartbleed was registered in theCommon Vulnerabilities and Exposuresdatabase asCVE-2014-0160.[7]The federalCanadian Cyber Incident Response Centreissued a security bulletin advising system administrators about the bug.[9]A fixed version of OpenSSL was released on 7 April 2014, on the same day Heartbleed was publicly disclosed.[10]

TLS implementations other than OpenSSL, such asGnuTLS,Mozilla'sNetwork Security Services,and theWindows platform implementation of TLS,were not affected because the defect existed in the OpenSSL's implementation of TLS rather than in the protocol itself.[11]

System administrators were frequently slow to patch their systems. As of 20 May 2014,1.5% of the 800,000 most popular TLS-enabled websites were still vulnerable to Heartbleed.[12]As of 21 June 2014,309,197 public web servers remained vulnerable.[13]As of 23 January 2017,according to a report[14]fromShodan,nearly 180,000 internet-connected devices were still vulnerable.[15][16]As of 6 July 2017,the number had dropped to 144,000, according to a search on shodan.io for "vuln:cve-2014-0160".[17]As of 11 July 2019,Shodan reported[18]that 91,063 devices were vulnerable. The U.S. was first with 21,258 (23%), the top 10 countries had 56,537 (62%), and the remaining countries had 34,526 (38%). The report also broke the devices down by 10 other categories such as organization (the top 3 were wireless companies), product (Apache httpd,Nginx), or service (HTTPS,81%).

History

[edit]

The Heartbeat Extension for theTransport Layer Security(TLS) andDatagram Transport Layer Security(DTLS) protocols was proposed as a standard in February 2012 byRFC6520.[19]It provides a way to test and keep alive secure communication links without the need to renegotiate the connection each time. In 2011, one of the RFC's authors, Robin Seggelmann, then a Ph.D. student at theFachhochschule Münster,implemented the Heartbeat Extension for OpenSSL. Following Seggelmann's request to put the result of his work into OpenSSL,[20][21][22]his change was reviewed by Stephen N. Henson, one of OpenSSL's four core developers. Henson failed to notice a bug in Seggelmann's implementation, and introduced the flawed code into OpenSSL's source code repository on 31 December 2011. The defect spread with the release of OpenSSL version 1.0.1 on 14 March 2012. Heartbeat support was enabled by default, causing affected versions to be vulnerable.[3][23]

Discovery

[edit]

According to Mark J. Cox of OpenSSL, Neel Mehta of Google's security team privately reported Heartbleed to the OpenSSL team on 1 April 2014 11:09 UTC.[24]

The bug was named by an engineer at Synopsys Software Integrity Group, a Finnish cyber security company that also created the bleeding heart logo[25]and launched an informational website, heartbleed.[26]While Google's security team reported Heartbleed to OpenSSL first, both Google and Codenomicon discovered it independently at approximately the same time.[27][28]Codenomicon reports 3 April 2014 as their date of discovery and their date of notification ofNCSC-FI[fi]for vulnerability coordination.[29]

At the time of disclosure, some 17% (around half a million) of the Internet's secure web servers certified bytrusted authoritieswere believed to be vulnerable to the attack, allowing theft of the servers'private keysand users' session cookies and passwords.[30][31][32][33][34]TheElectronic Frontier Foundation,[35]Ars Technica,[36]andBruce Schneier[37]all deemed the Heartbleed bug "catastrophic".Forbescybersecurity columnist Joseph Steinberg wrote:

Some might argue that Heartbleed is the worst vulnerability found (at least in terms of its potential impact) since commercial traffic began to flow on the Internet.[38]

An unidentified UK Cabinet Office spokesman recommended that:

People should take advice on changing passwords from the websites they use. Most websites have corrected the bug and are best placed to advise what action, if any, people need to take.[39]

On the day of disclosure,The Tor Projectadvised:

If you need strong anonymity or privacy on the Internet, you might want to stay away from the Internet entirely for the next few days while things settle.[40]

The Sydney Morning Heraldpublished a timeline of the discovery on 15 April 2014, showing that some organizations had been able to patch the bug before its public disclosure. In some cases, it is not clear how they found out.[41]

Bugfix and deployment

[edit]

Bodo Möller and Adam Langley ofGoogleprepared the fix for Heartbleed. The resulting patch was added toRed Hat's issue tracker on 21 March 2014.[42]Stephen N. Henson applied the fix to OpenSSL's version control system on 7 April.[43]The first fixed version, 1.0.1g, was released on the same day. As of 21 June 2014,309,197 public web servers remained vulnerable.[13]As of 23 January 2017,according to a report[14]from Shodan, nearly 180,000 internet-connected devices were still vulnerable.[15][16]The number had dropped to 144,000 as of 6 July 2017,according to a search on shodan.io for "vuln:cve-2014-0160".[17]

Certificate renewal and revocation

[edit]

According toNetcraft,about 30,000 of the 500,000+ X.509 certificates which could have been compromised due to Heartbleed had been reissued by 11 April 2014, although fewer had been revoked.[44]

By 9 May 2014, only 43% of affected web sites had reissued their security certificates. In addition, 7% of the reissued security certificates used the potentially compromised keys. Netcraft stated:

By reusing the same private key, a site that was affected by the Heartbleed bug still faces exactly the same risks as those that have not yet replaced theirSSL certificates.[45]

eWeeksaid, "[Heartbleed is] likely to remain a risk for months, if not years, to come."[46]

Cloudflarerevoked all TLS certificates and estimated that publishing itsCertificate revocation listwould cost the issuer,GlobalSign,$400,000 per month that year.[47]

Exploitation

[edit]

TheCanada Revenue Agencyreported a theft ofsocial insurance numbersbelonging to 900 taxpayers, and said that they were accessed through an exploit of the bug during a 6-hour period on 8 April 2014.[48]After the discovery of the attack, the agency shut down its website and extended the taxpayer filing deadline from 30 April to 5 May.[49]The agency said it would provide credit protection services at no cost to anyone affected. On 16 April, theRCMPannounced they had charged a computer science student in relation to the theft withunauthorized use of a computerandmischief in relation to data.[50][51]

The UK parenting siteMumsnethad several user accounts hijacked, and its CEO was impersonated.[52]The site later published an explanation of the incident saying it was due to Heartbleed and the technical staff patched it promptly.[53]

Anti-malware researchers also exploited Heartbleed to their own advantage in order to access secret forums used by cybercriminals.[54]Studies were also conducted by deliberately setting up vulnerable machines. For example, on 12 April 2014, at least two independent researchers were able to stealprivate keysfrom an experimental server intentionally set up for that purpose byCloudFlare.[55][56]Also, on 15 April 2014,J. Alex Halderman,a professor atUniversity of Michigan,reported that hishoneypotserver, an intentionally vulnerable server designed to attract attacks in order to study them, had received numerous attacks originating from China. Halderman concluded that because it was a fairly obscure server, these attacks were probably sweeping attacks affecting large areas of the Internet.[57]

In August 2014, it was made public that the Heartbleed vulnerability enabled hackers to steal security keys fromCommunity Health Systems,the second-biggest for-profit U.S. hospital chain in the United States, compromising the confidentiality of 4.5 million patient records. The breach happened a week after Heartbleed was first made public.[58]

Possible prior knowledge and exploitation

[edit]

Many major web sites patched the bug or disabled the Heartbeat Extension within days of its announcement,[59]but it is unclear whether potential attackers were aware of it earlier and to what extent it was exploited.[citation needed]

Based on examinations of audit logs by researchers, it has been reported that some attackers may have exploited the flaw for at least five months before discovery and announcement.[60][61]Errata Security pointed out that a widely used non-malicious program calledMasscan,introduced six months before Heartbleed's disclosure, abruptly terminates the connection in the middle of handshaking in the same way as Heartbleed, generating the same server log messages, adding "Two new things producing the same error messages might seem like the two are correlated, but of course, they aren't.[62]"

According toBloomberg News,two unnamed insider sources informed it that the United States'National Security Agencyhad been aware of the flaw since shortly after its appearance but‍—instead of reporting it‍—kept it secret among other unreportedzero-dayvulnerabilities in order to exploit it for the NSA's own purposes.[63][64][65]The NSA has denied this claim,[66]as hasRichard A. Clarke,a member of theNational Intelligence Review Group on Intelligence and Communications Technologiesthat reviewed the United States' electronic surveillance policy; he told Reuters on 11 April 2014 that the NSA had not known of Heartbleed.[67]The allegation prompted the American government to make, for the first time, a public statement on its zero-day vulnerabilities policy, accepting the recommendation of the review group's 2013 report that had asserted "in almost all instances, for widely used code, it is in the national interest to eliminate software vulnerabilities rather than to use them for US intelligence collection", and saying that the decision to withhold should move from the NSA to the White House.[68]

Behavior

[edit]
A depiction of Heartbleed.

The RFC 6520 Heartbeat Extension tests TLS/DTLS secure communication links by allowing a computer at one end of a connection to send aHeartbeat Requestmessage, consisting of a payload, typically a text string, along with the payload's length as a16-bitinteger. The receiving computer then must send exactly the same payload back to the sender.[citation needed]

The affected versions of OpenSSL allocate amemory bufferfor the message to be returned based on the length field in the requesting message, without regard to the actual size of that message's payload. Because of this failure to do properbounds checking,the message returned consists of the payload, possibly followed by whatever else happened to be in the allocated memory buffer.[citation needed]

Heartbleed is therefore exploited by sending a malformed heartbeat request with a small payload and large length field to the vulnerable party (usually a server) in order to elicit the victim's response, permitting attackers to read up to 64 kilobytes of the victim's memory that was likely to have been used previously by OpenSSL.[69]Where a Heartbeat Request might ask a party to "send back the four-letter word 'bird'", resulting in a response of "bird", a "Heartbleed Request" (a malicious heartbeat request) of "send back the 500-letter word 'bird'" would cause the victim to return "bird" followed by whatever 496 subsequent characters the victim happened to have in active memory. Attackers in this way could receive sensitive data, compromising the confidentiality of the victim's communications. Although an attacker has some control over the disclosed memory block's size, it has no control over its location, and therefore cannot choose what content is revealed.[citation needed]

Affected OpenSSL installations

[edit]

The affected versions of OpenSSL are OpenSSL 1.0.1 through 1.0.1f (inclusive). Subsequent versions (1.0.1g[70]and later) and previous versions (1.0.0 branch and older) are not vulnerable.[71]Installations of the affected versions are vulnerable unless OpenSSL was compiled with-DOPENSSL_NO_HEARTBEATS.[72][73]

Vulnerable program and function

[edit]

The vulnerable program source files are t1_lib.c and d1_both.c and the vulnerable functions are tls1_process_heartbeat() and dtls1_process_heartbeat().[74][75]

Patch

[edit]

The problem can be fixed by ignoring Heartbeat Request messages that ask for more data than their payload need, as required by the RFC.

Version 1.0.1g of OpenSSL adds some bounds checks to prevent the buffer over-read. For example, the following test was introduced to determine whether a heartbeat request would trigger Heartbleed; it silently discards malicious requests. 

if(1+2+payload+16>s->s3->rrec.length)return0;/* silently discard per RFC 6520 sec. 4 */

The OpenSSL version control system contains a complete list of changes.[43]

Impact

[edit]

The data obtained by a Heartbleed attack may include unencrypted exchanges between TLS parties likely to be confidential, including any formpost datain users' requests. Moreover, the confidential data exposed could include authentication secrets such assession cookiesand passwords, which might allow attackers to impersonate a user of the service.[76]

An attack may also revealprivate keysof compromised parties,[3][77]which would enable attackers to decrypt communications (future or past stored traffic captured via passive eavesdropping, unlessperfect forward secrecyis used, in which case only future traffic can be decrypted if intercepted viaman-in-the-middle attacks).[citation needed]

An attacker having gained authentication material may impersonate the material's owner after the victim has patched Heartbleed, as long as the material is accepted (for example, until the password is changed or the private key revoked). Heartbleed therefore constitutes a critical threat to confidentiality. However, an attacker impersonating a victim may also alter data. Indirectly, Heartbleed's consequences may thus go far beyond a confidentiality breach for many systems.[78]

A survey of American adults conducted in April 2014 showed that 60 percent had heard about Heartbleed. Among those using the Internet, 39 percent had protected their online accounts, for example by changing passwords or canceling accounts; 29 percent believed their personal information was put at risk because of the Heartbleed bug; and 6 percent believed their personal information had been stolen.[79]

Client-side vulnerability

[edit]

Although the bug received more attention due to the threat it represents for servers,[80]TLS clients using affected OpenSSL instances are also vulnerable. In whatThe Guardiantherefore dubbedReverse Heartbleed,malicious servers are able to exploit Heartbleed to read data from a vulnerable client's memory.[81]Security researcher Steve Gibson said of Heartbleed that:

It's not just a server-side vulnerability, it's also a client-side vulnerability because the server, or whomever you connect to, is as able to ask you for a heartbeat back as you are to ask them.[82]

The stolen data could contain usernames and passwords.[83]Reverse Heartbleed affected millions of application instances.[81]Some of the vulnerable applications are listed in the"Software applications" section below.[citation needed]

Specific systems affected

[edit]

Cisco Systemshas identified 78 of its products as vulnerable, including IP phone systems and telepresence (video conferencing) systems.[84]

Websites and other online services

[edit]

An analysis posted onGitHubof the most visited websites on 8 April 2014 revealed vulnerabilities in sites includingYahoo!,Imgur,Stack Overflow,Slate,andDuckDuckGo.[85][86]The following sites have services affected or made announcements recommending that users update passwords in response to the bug:

The Canadian federal government temporarily shut online services of theCanada Revenue Agency(CRA) and several government departments over Heartbleed bug security concerns.[111][112]Before the CRA online services were shut down, a hacker obtained approximately 900social insurance numbers.[113][114]Another Canadian Government agency,Statistics Canada,had its servers compromised due to the bug and also temporarily took its services offline.[115]

Platform maintainers like the Wikimedia Foundation advised their users to change passwords.[108]

The servers ofLastPasswere vulnerable,[116]but due to additional encryption and forward secrecy, potential attacks were not able to exploit this bug. However, LastPass recommended that its users change passwords for vulnerable websites.[117]

TheTorProject recommended that Tor relay operators and hidden service operators revoke and generate fresh keys after patching OpenSSL, but noted that Tor relays use two sets of keys and that Tor's multi-hop design minimizes the impact of exploiting a single relay.[40]586 relays later found to be susceptible to the Heartbleed bug were taken off-line as a precautionary measure.[118][119][120][121]

Game-related services includingSteam,Minecraft,Wargaming,League of Legends,GOG,Origin,Sony Online Entertainment,Humble Bundle,andPath of Exilewere affected and subsequently fixed.[122]

Software applications

[edit]

Vulnerable software applications include:

  • SeveralHewlett-Packardserver applications, such as HP System Management Homepage (SMH) for Linux and Windows.[123]
  • Some versions ofFileMaker13[124]
  • LibreOffice4.2.0 to 4.2.2 (fixed in 4.2.3)[125][126]
  • LogMeInclaimed to have "updated many products and parts of our services that rely on OpenSSL".[127]
  • MultipleMcAfeeproducts, in particular some versions of software providing anti-viral coverage for Microsoft Exchange, software firewalls, and McAfee Email and Web Gateways[128]
  • OracleMySQLConnector/C 6.1.0-6.1.3 and Connector/ODBC 5.1.13, 5.2.5-5.2.6, 5.3.2[129]
  • Oracle Big Data Appliance(includes Oracle Linux 6)[129]
  • PrimaveraP6 Professional Project Management (includes Primavera P6 Enterprise Project Portfolio Management)[129]
  • WinSCP(FTP client for Windows) 5.5.2 and some earlier versions (only vulnerable with FTP over TLS/SSL, fixed in 5.5.3)[130]
  • MultipleVMwareproducts, includingVMware ESXi5.5,VMware Player6.0,VMware Workstation10 and the series of Horizon products, emulators and cloud computing suites[131]

Several otherOracle Corporationapplications were affected.[129]

Operating systems/firmware

[edit]

Several Linux distributions were affected, includingDebian[132](and derivatives such asLinux MintandUbuntu[133]) andRed Hat Enterprise Linux[134](and derivatives such asCentOS,[135]Oracle Linux6[129]andAmazon Linux[136]), as well as the following operating systems and firmware implementations:

Vulnerability testing services

[edit]

Several services have been made available to test whether Heartbleed affects a given site. However, many services have been claimed to be ineffective for detecting the bug.[148]The available tools include:

  • Tripwire SecureScan[149]
  • AppCheck – static binary scan and fuzzing, from Synopsys Software Integrity Group (formerly Codenomicon)[150]
  • Arbor Network's Pravail Security Analytics[151]
  • Norton Safeweb Heartbleed Check Tool[152]
  • Heartbleed testing tool by a European IT security company[153]
  • Heartbleed test by Italian cryptographer Filippo Valsorda[154]
  • Heartbleed Vulnerability Test byCyberoam[155]
  • Critical Watch Free Online Heartbleed Tester[156]
  • MetasploitHeartbleed scanner module[157]
  • Heartbleed Server Scanner by Rehmann[158]
  • Lookout Mobile Security Heartbleed Detector, an app forAndroiddevices that determines the OpenSSL version of the device and indicates whether the vulnerable heartbeat is enabled[159]
  • Heartbleed checker hosted byLastPass[160]
  • Online network range scanner for Heartbleed vulnerability by Pentest-Tools[161]
  • OfficialRed Hatoffline scanner written in the Python language[162]
  • QualysSSL Labs' SSL Server Test[163]which not only looks for the Heartbleed bug, but can also find other SSL/TLS implementation errors.
  • Browser extensions, such as Chromebleed[164]and FoxBleed[165]
  • SSL Diagnos[166]
  • CrowdStrike Heartbleed Scanner[167]– Scans routers, printers and other devices connected inside a network including intranet web sites.[168]
  • Netcraft Site Report[169]– indicates whether a website's confidentiality could be jeopardized due to a past exploitation of Heartbleed by checking data from Netcraft's SSL Survey to determine whether a site offered the heartbeat TLS Extension prior to the Heartbleed disclosure. The Netcraft Extensions for Chrome, Firefox and Opera[170]also perform this check, whilst looking for potentially compromised certificates.[171]

Other security tools have added support for finding this bug. For example, Tenable Network Security wrote a plugin for itsNessusvulnerability scanner that can scan for this fault.[172]TheNmapsecurity scanner includes a Heartbleed detection script from version 6.45.[173]

Sourcefirehas releasedSnortrules to detect Heartbleed attack traffic and possible Heartbleed response traffic.[174]Open source packet analysis software such asWiresharkandtcpdumpcan identify Heartbleed packets using specific BPF packet filters that can be used on stored packet captures or live traffic.[175]

Remediation

[edit]

Vulnerability to Heartbleed is resolved by updating OpenSSL to apatchedversion (1.0.1g or later). OpenSSL can be used either as a standalone program, adynamic shared object,or astatically-linked library;therefore, the updating process can require restarting processes loaded with a vulnerable version of OpenSSL as well as re-linking programs and libraries that linked it statically. In practice this means updating packages that link OpenSSL statically, and restarting running programs to remove the in-memory copy of the old, vulnerable OpenSSL code.[citation needed]

After the vulnerability is patched, server administrators must address the potential breach of confidentiality. Because Heartbleed allowed attackers to discloseprivate keys,they must be treated as compromised; key pairs must be regenerated, andcertificatesthat use them must be reissued; the old certificates must berevoked.Heartbleed also had the potential to allow disclosure of other in-memory secrets; therefore, other authentication material (such aspasswords) should also be regenerated. It is rarely possible to confirm that a system which was affected has not been compromised, or to determine whether a specific piece of information was leaked.[176]

Since it is difficult or impossible to determine when a credential might have been compromised and how it might have been used by an attacker, certain systems may warrant additional remediation work even after patching the vulnerability and replacing credentials. For example, signatures made by keys that were in use with a vulnerable OpenSSL version might well have been made by an attacker; this raises the possibility integrity has been violated, and opens signatures torepudiation.Validation of signatures and the legitimacy of other authentications made with a potentially compromised key (such asclient certificateuse) must be done with regard to the specific system involved.[citation needed]

Browser security certificate revocation awareness

[edit]

Since Heartbleed threatened the privacy of private keys, users of a website which was compromised could continue to suffer from Heartbleed's effects until their browser is made aware of the certificate revocation or the compromised certificate expires.[177]For this reason, remediation also depends on users making use of browsers that have up-to-date certificate revocation lists (orOCSPsupport) and honour certificate revocations.[citation needed]

Root causes, possible lessons, and reactions

[edit]

Although evaluating the total cost of Heartbleed is difficult,eWeekestimated US$500 million as a starting point.[178]

David A. Wheeler's paperHow to Prevent the next Heartbleedanalyzes why Heartbleed wasn't discovered earlier, and suggests several techniques which could have led to a faster identification, as well as techniques which could have reduced its impact. According to Wheeler, the most efficient technique which could have prevented Heartbleed is a test suite thoroughly performingrobustness testing,i.e. testing that invalid inputs cause failures rather than successes. Wheeler highlights that a single general-purpose test suite could serve as a base for all TLS implementations.[179]

According to an article onThe Conversationwritten by Robert Merkel, Heartbleed revealed amassive failure of risk analysis.Merkel thinks OpenSSL gives more importance to performance than to security, which no longer makes sense in his opinion. But Merkel considers that OpenSSL should not be blamed as much as OpenSSL users, who chose to use OpenSSL, without funding better auditing and testing. Merkel explains that two aspects determine the risk that more similar bugs will cause vulnerabilities. One, the library's source code influences the risk of writing bugs with such an impact. Secondly, OpenSSL's processes affect the chances of catching bugs quickly. On the first aspect, Merkel mentions the use of theC programming languageas one risk factor which favored Heartbleed's appearance, echoing Wheeler's analysis.[179][180]

On the same aspect,Theo de Raadt,founder and leader of theOpenBSDandOpenSSHprojects, has criticized the OpenSSL developers for writing their own memory management routines and thereby, he claims, circumventing OpenBSDC standard libraryexploit countermeasures, saying "OpenSSL is not developed by a responsible team."[181][182]Following Heartbleed's disclosure, members of the OpenBSD projectforkedOpenSSL intoLibreSSL.[183]LibreSSL made a big code cleanup, removing more than 90,000 lines of C code just in its first week.[184]

The author of the change which introduced Heartbleed, Robin Seggelmann,[185]stated that hemissed validating a variable containing a lengthand denied any intention to submit a flawed implementation.[20]Following Heartbleed's disclosure, Seggelmann suggested focusing on the second aspect, stating that OpenSSL is not reviewed by enough people.[186]Although Seggelmann's work was reviewed by an OpenSSL core developer, the review was also intended to verify functional improvements, a situation making vulnerabilities much easier to miss.[179]

OpenSSL core developerBen Laurieclaimed that a security audit of OpenSSL would have caught Heartbleed.[187]Software engineer John Walsh commented:

Think about it, OpenSSL only has two [fulltime] people to write, maintain, test, and review 500,000 lines of business critical code.[188]

The OpenSSL foundation's president, Steve Marquess, said "The mystery is not that a few overworked volunteers missed this bug; the mystery is why it hasn't happened more often."[188]David A. Wheeler described audits as an excellent way to find vulnerabilities in typical cases, but noted that "OpenSSL uses unnecessarily complex structures, which makes it harder to both humans and machines to review." He wrote:

There should be a continuous effort to simplify the code, because otherwise just adding capabilities will slowly increase the software complexity. The code should be refactored over time to make it simple and clear, not just constantly add new features. The goal should be code that is "obviously right", as opposed to code that is so complicated that "I can't see any problems".[179]

According to security researcherDan Kaminsky,Heartbleed is sign of an economic problem which needs to be fixed. Seeing the time taken to catch this simple error in a simple feature from a "critical" dependency, Kaminsky fears numerous future vulnerabilities if nothing is done. When Heartbleed was discovered, OpenSSL was maintained by a handful of volunteers, only one of whom worked full time.[189]Yearly donations to the OpenSSL project were about US$2,000.[190]The Heartbleed website from Codenomicon advised money donations to the OpenSSL project.[3]After learning about donations for the 2 or 3 days following Heartbleed's disclosure totaling US$841, Kaminsky commented "We are building the most important technologies for the global economy on shockingly underfunded infrastructure."[191]Core developer Ben Laurie has qualified the project as "completely unfunded".[190]Although the OpenSSL Software Foundation has nobug bounty program,the Internet Bug Bounty initiative awarded US$15,000 to Google's Neel Mehta, who discovered Heartbleed, for his responsible disclosure.[190]Mehta later donated his reward to aFreedom of the Press Foundationfundraiser.[192]

Paul Chiusano suggested Heartbleed may have resulted from failed software economics.[193]

The industry's collective response to the crisis was theCore Infrastructure Initiative,a multimillion-dollar project announced by theLinux Foundationon 24 April 2014 to provide funds to critical elements of the global information infrastructure.[194]The initiative intends to allow lead developers to work full time on their projects and to pay for security audits, hardware and software infrastructure, travel, and other expenses.[195]OpenSSL is a candidate to become the first recipient of the initiative's funding.[194]

After the discovery Google establishedProject Zerowhich is tasked with findingzero-day vulnerabilitiesto help secure the Web and society.[196][197]

References

[edit]
  1. ^McKenzie, Patrick (9 April 2014)."What Heartbleed Can Teach The OSS Community About Marketing".Kalzumeus.Archivedfrom the original on 20 December 2017.Retrieved8 February2018.
  2. ^Biggs, John (9 April 2014)."Heartbleed, The First Security Bug With A Cool Logo".TechCrunch.Archivedfrom the original on 11 February 2018.Retrieved8 February2018.
  3. ^abcde"Heartbleed Bug".11 October 2023.Archivedfrom the original on 7 April 2014.Retrieved9 April2014.
  4. ^Pitkänen, Perttu (9 April 2014)."Näin suomalaistutkijat löysivät vakavan vuodon internetin sydämestä"[This is how Finnish researchers discovered a serious leak in the heart of the internet].Ilta-Sanomat(in Finnish).Retrieved11 October2023.
  5. ^"Security Advisory – OpenSSL Heartbleed Vulnerability".Cyberoam.11 April 2014.Archivedfrom the original on 8 February 2018.Retrieved8 February2018.
  6. ^Limer, Eric (9 April 2014)."How Heartbleed Works: The Code Behind the Internet's Security Nightmare".Gizmodo.Archivedfrom the original on 11 November 2014.Retrieved24 November2014.
  7. ^ab"CVE-2014-0160".Common Vulnerabilities and Exposures.Mitre.Archivedfrom the original on 24 January 2018.Retrieved8 February2018.
  8. ^"CWE-126: Buffer Over-read (3.0)".Common Vulnerabilities and Exposures.Mitre.18 January 2018.Archivedfrom the original on 8 February 2018.Retrieved8 February2018.
  9. ^"AL14-005: OpenSSL Heartbleed Vulnerability".Cyber Security Bulletins.Public Safety Canada.11 April 2014.Archivedfrom the original on 8 February 2018.Retrieved8 February2018.
  10. ^"Add heartbeat extension bounds check".git.openssl.org.OpenSSL.Retrieved5 March2019.
  11. ^Pretorius, Tracey (10 April 2014)."Microsoft Services unaffected by OpenSSL" Heartbleed "vulnerability".Microsoft.Archivedfrom the original on 8 February 2018.Retrieved8 February2018.
  12. ^Leyden, John (20 May 2014)."AVG on Heartbleed: It's dangerous to go alone. Take this (an AVG tool)".The Register.Archivedfrom the original on 23 January 2018.Retrieved8 February2018.
  13. ^abGraham, Robert (21 June 2014)."300k servers vulnerable to Heartbleed two months later".Errata Security.Archivedfrom the original on 23 June 2014.Retrieved22 June2014.
  14. ^abShodan (23 January 2017)."Heartbleed Report (2017-01)".shodan.io. Archived fromthe originalon 23 January 2017.Retrieved10 July2019.
  15. ^abSchwartz, Mathew J. (30 January 2017)."Heartbleed Lingers: Nearly 180,000 Servers Still Vulnerable".Bank Info Security.Archivedfrom the original on 11 July 2019.Retrieved10 July2019.
  16. ^abMac Vittie, Lori (2 February 2017)."Friendly Reminder: App Security in the Cloud Is Your Responsibility".F5 Labs.Archivedfrom the original on 11 July 2019.Retrieved10 July2019.
  17. ^abCarey, Patrick (10 July 2017)."Heartbleed's Heartburn: Why a 5 Year Old Vulnerability Continues to Bite".The Security Ledger.Archivedfrom the original on 11 July 2019.Retrieved10 July2019.
  18. ^Shodan (11 July 2019)."[2019] Heartbleed Report".Shodan.Archivedfrom the original on 11 July 2019.Retrieved11 July2019.
  19. ^Seggelmann, Robin; Tuexen, Michael; Williams, Michael (February 2012).Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension.IETF.doi:10.17487/RFC6520.ISSN2070-1721.RFC6520.Retrieved8 February2018.
  20. ^abGrubb, Ben (11 April 2014)."Man who introduced serious 'Heartbleed' security flaw denies he inserted it deliberately".The Sydney Morning Herald.[permanent dead link]
  21. ^"#2658: [PATCH] Add TLS/DTLS Heartbeats".OpenSSL. 2011. Archived fromthe originalon 8 August 2017.Retrieved13 April2014.
  22. ^"Meet the man who created the bug that almost broke the Internet".Globe and Mail.11 April 2014.Archivedfrom the original on 4 January 2018.Retrieved27 August2017.
  23. ^Goodin, Dan (8 April 2014)."Critical crypto bug in OpenSSL opens two-thirds of the Web to eavesdropping".Ars Technica.Archivedfrom the original on 5 July 2017.Retrieved14 June2017.
  24. ^"Mark J Cox – #Heartbleed".Archivedfrom the original on 16 April 2014.Retrieved12 April2014.
  25. ^Pitkänen, Perttu (10 April 2014)."Oululaiset sorvasivat nimen ja logon: Näin superbugi tuotteistettiin"[The people of Oulu turned the name and logo: This is how the superbug was produced].Ilta-Sanomat(in Finnish).Retrieved11 October2023.
  26. ^Dewey, Caitlin."Why is it called the 'Heartbleed Bug'?".Archivedfrom the original on 9 October 2014.Retrieved25 November2014.
  27. ^Lee, Timothy B. (10 April 2014)."Who discovered the vulnerability?".Vox.Archivedfrom the original on 5 December 2017.Retrieved4 December2017.
  28. ^Lee, Ariana (13 April 2014)."How Codenomicon Found The Heartbleed Bug Now Plaguing The Internet".ReadWrite.Archivedfrom the original on 5 September 2017.Retrieved4 December2017.Discovered independently by Google engineer Neel Mehta and the Finnish security firm Codenomicon, Heartbleed has been called 'one of the most serious security problems to ever affect the modern web.'
  29. ^"Näin suomalaistutkijat löysivät vakavan vuodon internetin sydämestä – transl/Finnish researchers found a serious leakage of the heart of the Internet".10 April 2014.Archivedfrom the original on 4 November 2014.Retrieved13 April2014.
  30. ^Mutton, Paul (8 April 2014)."Half a million widely trusted websites vulnerable to Heartbleed bug".Netcraft.Archivedfrom the original on 19 November 2014.Retrieved24 November2014.
  31. ^Perlroth, Nicole; Hardy, Quentin (11 April 2014)."Heartbleed Flaw Could Reach to Digital Devices, Experts Say".The New York Times.Archivedfrom the original on 28 April 2019.Retrieved27 February2017.
  32. ^Chen, Brian X. (9 April 2014)."Q. and A. on Heartbleed: A Flaw Missed by the Masses".The New York Times.Archivedfrom the original on 12 April 2014.Retrieved10 April2014.
  33. ^Wood, Molly (10 April 2014)."Flaw Calls for Altering Passwords, Experts Say".The New York Times.Archivedfrom the original on 19 October 2017.Retrieved27 February2017.
  34. ^Manjoo, Farhad (10 April 2014)."Users' Stark Reminder: As Web Grows, It Grows Less Secure".The New York Times.Archivedfrom the original on 24 February 2018.Retrieved27 February2017.
  35. ^Zhu, Yan (8 April 2014)."Why the Web Needs Perfect Forward Secrecy More Than Ever".Electronic Frontier Foundation.Archivedfrom the original on 20 December 2017.Retrieved10 April2014.
  36. ^Goodin, Dan (8 April 2014)."Critical crypto bug exposes Yahoo Mail, other passwords Russian roulette-style".Ars Technica.Archivedfrom the original on 14 July 2017.Retrieved14 June2017.
  37. ^"Schneier on Security: Heartbleed".Schneier on Security.11 April 2014.Archivedfrom the original on 23 December 2017.Retrieved10 April2014.
  38. ^Steinberg, Joseph (10 April 2014)."Massive Internet Security Vulnerability – Here's What You Need To Do".Forbes.Archivedfrom the original on 4 January 2018.Retrieved29 August2017.
  39. ^Kelion, Leo (11 April 2014)."US government warns of Heartbleed bug danger".BBC News.Archivedfrom the original on 6 December 2018.Retrieved21 June2018.
  40. ^ab"OpenSSL bug CVE-2014-0160".Tor Project. 7 April 2014.Archivedfrom the original on 10 July 2017.Retrieved9 April2014.
  41. ^Grubb, Ben (14 April 2014)."Heartbleed disclosure timeline: who knew what and when".The Sydney Morning Herald.Archivedfrom the original on 25 November 2014.Retrieved25 November2014.
  42. ^"heartbeat_fix".Archivedfrom the original on 19 November 2018.Retrieved14 April2014.
  43. ^ab""complete list of changes" (Git – openssl.git/commitdiff) ".The OpenSSL Project. 7 April 2014.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  44. ^"Heartbleed certificate revocation tsunami yet to arrive".Netcraft.11 April 2014.Archivedfrom the original on 29 May 2014.Retrieved24 April2014.
  45. ^Mutton, Paul (9 May 2014)."Keys left unchanged in many Heartbleed replacement certificates!".Netcraft.Archivedfrom the original on 27 August 2016.Retrieved11 September2016.
  46. ^Kerner, Sean Michael (10 May 2014)."Heartbleed Still a Threat to Hundreds of Thousands of Servers".eWeek.Archived fromthe originalon 11 May 2014.
  47. ^Prince, Matthew (17 April 2014)."The hidden costs of Heartbleed".Cloudflare.Archived fromthe originalon 30 April 2016.
  48. ^Evans, Pete (14 April 2014)."Heartbleed bug: 900 SINs stolen from Revenue Canada".CBC News.Archivedfrom the original on 14 March 2018.Retrieved4 November2014.Some of the details are in the video linked from the page.
  49. ^"Canada Revenue Agency pushes tax deadline to May 5 after Heartbleed bug".14 April 2014. Archived fromthe originalon 4 November 2014.Retrieved4 November2014.
  50. ^Thibedeau, Hannah (16 April 2014)."Heartbleed bug accused charged by RCMP after SIN breach".CBC News.Archivedfrom the original on 28 October 2014.Retrieved4 November2014.
  51. ^"Heartbleed hack case sees first arrest in Canada".BBC News.16 April 2014.Archivedfrom the original on 23 May 2018.Retrieved21 June2018.
  52. ^abKelion, Leo (14 April 2014)."Heartbleed hacks hit Mumsnet and Canada's tax agency".BBC News.Archivedfrom the original on 29 November 2017.Retrieved21 June2018.
  53. ^"Mumsnet and Heartbleed as it happened".Mumsnet.Archived fromthe originalon 29 December 2017.Retrieved17 April2014.
  54. ^Ward, Mark (29 April 2014)."Heartbleed used to uncover data from cyber-criminals".BBC News.Archivedfrom the original on 14 May 2018.Retrieved21 June2018.
  55. ^Lawler, Richard (11 April 2014)."Cloudflare Challenge proves 'worst case scenario' for Heartbleed is actually possible".Engadget.Archivedfrom the original on 29 December 2017.Retrieved29 August2017.
  56. ^"The Heartbleed Challenge".CloudFlare.2014. Archived fromthe originalon 12 April 2014.
  57. ^Robertson, Jordan (16 April 2014)."Hackers from China waste little time in exploiting Heartbleed".The Sydney Morning Herald.Archivedfrom the original on 28 December 2017.Retrieved16 April2020.
  58. ^Frizell, Sam (20 August 2014)."Report: Devastating Heartbleed Flaw Was Used in Hospital Hack".Time.Archivedfrom the original on 7 October 2014.Retrieved7 October2014.
  59. ^Cipriani, Jason (9 April 2014)."Heartbleed bug: Check which sites have been patched".CNET.Archivedfrom the original on 17 April 2020.Retrieved16 April2020.
  60. ^Gallagher, Sean (9 April 2014)."Heartbleed vulnerability may have been exploited months before patch".Ars Technica.Archivedfrom the original on 3 March 2017.Retrieved14 June2017.
  61. ^Eckersley, Peter (10 April 2014)."Wild at Heart: Were Intelligence Agencies Using Heartbleed in November 2013?".Eff.org.Archivedfrom the original on 5 December 2014.Retrieved25 November2014.
  62. ^Graham, Robert (9 April 2014)."No, we weren't scanning for hearbleed before April 7".Errata Security.Archivedfrom the original on 16 October 2017.Retrieved10 April2014.
  63. ^Riley, Michael (12 April 2014)."NSA Said to Exploit Heartbleed Bug for Intelligence for Years".Bloomberg.Archivedfrom the original on 11 April 2014.Retrieved7 March2017.
  64. ^Molina, Brett."Report: NSA exploited Heartbleed for years".USA Today.Archivedfrom the original on 11 April 2014.Retrieved11 April2014.
  65. ^Riley, Michael."NSA exploited Heartbleed bug for two years to gather intelligence, sources say".Financial Post.Archivedfrom the original on 11 April 2014.Retrieved11 April2014.
  66. ^"Statement on Bloomberg News story that NSA knew about the 'Heartbleed bug' flaw and regularly used it to gather critical intelligence".National Security Agency.11 April 2014.Archivedfrom the original on 27 December 2017.Retrieved13 April2014.
  67. ^Hosenball, Mark; Dunham, Will (11 April 2014)."White House, spy agencies deny NSA exploited 'Heartbleed' bug".Reuters.Archivedfrom the original on 15 April 2014.Retrieved1 July2017.
  68. ^Zetter, Kim."U.S. Gov Insists It Doesn't Stockpile Zero-Day Exploits to Hack Enemies".Wired.wired.Archivedfrom the original on 29 November 2014.Retrieved25 November2014.
  69. ^Hunt, Troy (9 April 2014)."Everything you need to know about the Heartbleed SSL bug".Troyhunt.Archivedfrom the original on 11 April 2014.Retrieved11 April2014.
  70. ^"git.openssl.org Git – openssl.git/log".git.openssl.org.Archived fromthe originalon 15 April 2014.Retrieved25 November2014.
  71. ^"Spiceworks Community Discussions".community.spiceworks.Archivedfrom the original on 15 April 2014.Retrieved11 April2014.
  72. ^"OpenSSL Security Advisory [07 Apr 2014]".The OpenSSL Project.7 April 2014.Archivedfrom the original on 8 April 2014.Retrieved9 April2014.
  73. ^"OpenSSL versions and vulnerability [9 April 2014]".Comodo.Archived fromthe originalon 5 July 2014.Retrieved9 April2014.
  74. ^"Cyberoam Users Need not Bleed over Heartbleed Exploit".cyberoam. Archived fromthe originalon 15 April 2014.Retrieved11 April2014.
  75. ^"tls1_process_heartbeat [9 April 2014]".Archivedfrom the original on 26 August 2014.Retrieved10 April2014.
  76. ^"Why Heartbleed is dangerous? Exploiting CVE-2014-0160".IPSec.pl. 2014. Archived fromthe originalon 8 April 2014.Retrieved9 April2014.
  77. ^Graham-Cumming, John (28 April 2014)."Searching for The Prime Suspect: How Heartbleed Leaked Private Keys".CloudFlare.Archivedfrom the original on 29 December 2017.Retrieved7 June2014.
  78. ^Judge, Kevin."Servers Vulnerable to Heartbleed [14 July 2014]".Archived fromthe originalon 26 August 2014.Retrieved25 August2014.
  79. ^Rainie, Lee; Duggan, Maeve (30 April 2014)."Heartbleed's Impact".Pew Research Internet Project.Pew Research Center.p. 2.Archivedfrom the original on 28 December 2017.Retrieved22 May2014.
  80. ^Bradley, Tony (14 April 2014)."Reverse Heartbleed puts your PC and devices at risk of OpenSSL attack".PC World.IDG Consumer & SMB.Archivedfrom the original on 2 December 2016.Retrieved10 May2014.
  81. ^abArthur, Charles (15 April 2014)."Heartbleed makes 50m Android phones vulnerable, data shows".The Guardian.Guardian News and Media Limited.Archivedfrom the original on 19 March 2016.Retrieved14 December2016.
  82. ^"Security Now 451".Twit.Tv.Archivedfrom the original on 19 April 2014.Retrieved19 April2014.
  83. ^Ramzan, Zulfikar (24 April 2014)."'Reverse Heartbleed' can attack PCs and mobile phones ".SC Magazine.Haymarket Media, Inc.Archivedfrom the original on 6 October 2016.Retrieved10 May2014.
  84. ^ab"OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products".Cisco Systems. 9 April 2014.Archivedfrom the original on 29 December 2017.Retrieved8 May2014.
  85. ^"heartbleed-masstest: Overview".GitHub.Archivedfrom the original on 1 June 2014.Retrieved19 April2014.
  86. ^Cipriani, Jason (10 April 2014)."Which sites have patched the Heartbleed bug?".CNET.Archivedfrom the original on 11 April 2014.Retrieved10 April2014.
  87. ^"Heartbleed FAQ: Akamai Systems Patched".Akamai Technologies.8 April 2014.Archivedfrom the original on 8 April 2014.Retrieved9 April2014.
  88. ^"AWS Services Updated to Address OpenSSL Vulnerability".Amazon Web Services.8 April 2014.Archivedfrom the original on 11 April 2014.Retrieved9 April2014.
  89. ^"Dear readers, please change your Ars account passwords ASAP".Ars Technica. 8 April 2014.Archivedfrom the original on 18 January 2017.Retrieved14 June2017.
  90. ^"All Heartbleed upgrades are now complete".BitBucket Blog. 9 April 2014.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  91. ^"Keeping Your BrandVerity Account Safe from the Heartbleed Bug".BrandVerity Blog. 9 April 2014.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  92. ^@freenodestaff (8 April 2014)."we've had to restart a bunch of servers due to an openssl security vulnerability, which is/was very noisy. So sorry!"(Tweet) – viaTwitter.
  93. ^"Security: Heartbleed vulnerability".GitHub.8 April 2014.Archivedfrom the original on 10 April 2014.Retrieved9 April2014.
  94. ^"IFTTT Says It Is 'No Longer Vulnerable' To Heartbleed".LifeHacker.8 April 2014.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  95. ^"Heartbleed bug and the Archive".Internet Archive Blogs.9 April 2014.Retrieved14 April2014.
  96. ^@KrisJelbring (8 April 2014)."If you logged in to any of our games or websites in the last 24 hours using your username+password I'd recommend you to change your password"(Tweet).Retrieved14 April2014– viaTwitter.
  97. ^"The widespread OpenSSL 'Heartbleed' bug is patched in PeerJ".PeerJ.9 April 2014.Archivedfrom the original on 13 April 2014.Retrieved9 April2014.
  98. ^"Was Pinterest impacted by the Heartbleed issue?".Pinterest Help Center.Archived fromthe originalon 21 April 2014.Retrieved20 April2014.
  99. ^"Heartbleed Defeated".Prezi.Archived fromthe originalon 5 June 2014.Retrieved13 April2014.
  100. ^"We recommend that you change your reddit password".Reddit.14 April 2014.Archivedfrom the original on 15 April 2014.Retrieved14 April2014.
  101. ^"IMPORTANT ANNOUNCEMENTS FROM THE MAKERS OF CHILI".Archivedfrom the original on 28 July 2013.Retrieved13 April2014.
  102. ^Codey, Brendan (9 April 2014)."Security Update: We're going to sign out everyone today, here's why".SoundCloud.Archivedfrom the original on 13 April 2014.Retrieved9 April2014.
  103. ^"SourceForge response to Heartbleed".SourceForge.10 April 2014.Archivedfrom the original on 11 April 2014.Retrieved10 April2014.
  104. ^"Heartbleed".SparkFun.9 April 2014.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  105. ^"Heartbleed".Stripe (company).9 April 2014.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  106. ^"Tumblr Staff-Urgent security update".8 April 2014.Archivedfrom the original on 9 April 2014.Retrieved9 April2014.
  107. ^Hern, Alex (9 April 2014)."Heartbleed: don't rush to update passwords, security experts warn".The Guardian.Archivedfrom the original on 3 January 2017.Retrieved14 December2016.
  108. ^abGrossmeier, Greg (8 April 2014)."[Wikitech-l] Fwd: Security precaution – Resetting all user sessions today".Wikimedia Foundation.Archivedfrom the original on 18 June 2014.Retrieved9 April2014.
  109. ^Grossmeier, Greg (10 April 2014)."Wikimedia's response to the" Heartbleed "security vulnerability".Wikimedia Foundation blog.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  110. ^"Wunderlist & the Heartbleed OpenSSL Vulnerability".10 April 2014. Archived fromthe originalon 13 April 2014.Retrieved10 April2014.
  111. ^"Security concerns prompts tax agency to shut down website".CTV News.9 April 2014.Archivedfrom the original on 18 January 2021.Retrieved9 April2014.
  112. ^"Heartbleed: Canadian tax services back online".CBC News.Archivedfrom the original on 25 April 2018.Retrieved14 April2014.
  113. ^Ogrodnik, Irene (14 April 2014)."900 SINs stolen due to Heartbleed bug: Canada Revenue Agency | Globalnews.ca".globalnews.ca.Global News.Archivedfrom the original on 4 May 2019.Retrieved4 May2019.
  114. ^Seglins, Dave (3 December 2014)."CRA Heartbleed hack: Stephen Solis-Reyes facing more charges".cbc.ca.CBC News.Archivedfrom the original on 4 May 2019.Retrieved4 May2019.
  115. ^"The Statistics Canada Site Was Hacked By an Unknown Attacker".Vice – Motherboard.Archivedfrom the original on 24 December 2018.Retrieved23 December2018.
  116. ^Fiegerman, Seth (14 April 2014)."The Heartbleed Effect: Password Services Are Having a Moment".Mashable.Archivedfrom the original on 16 October 2017.Retrieved28 April2014.
  117. ^"LastPass and the Heartbleed Bug".LastPass.8 April 2014.Archivedfrom the original on 18 December 2017.Retrieved28 April2014.
  118. ^"[tor-relays] Rejecting 380 vulnerable guard/exit keys".Lists.torproject.org. 16 April 2014.Archivedfrom the original on 19 April 2014.Retrieved19 April2014.
  119. ^"Tor Weekly News—April 16th, 2014 | The Tor Blog".Blog.torproject.org.Archivedfrom the original on 19 April 2014.Retrieved19 April2014.
  120. ^Gallagher, Sean (17 May 2012)."Tor network's ranks of relay servers cut because of Heartbleed bug".Ars Technica.Archivedfrom the original on 1 May 2014.Retrieved19 April2014.
  121. ^Mimoso, Michael (17 April 2014)."Tor Blacklisting Exit Nodes Vulnerable to Heartbleed Bug | Threatpost | The first stop for security news".Threatpost.Archivedfrom the original on 19 April 2014.Retrieved19 April2014.
  122. ^Younger, Paul (11 April 2014)."PC game services affected by Heartbleed and actions you need to take".IncGamers.Archivedfrom the original on 15 April 2014.Retrieved15 April2014.
  123. ^"HP Servers Communication: OpenSSL" HeartBleed "Vulnerability".18 April 2014. Archived fromthe originalon 4 March 2016.
  124. ^"FileMaker products and the Heartbleed bug".6 May 2014.Archivedfrom the original on 12 October 2016.Retrieved8 May2014.
  125. ^italovignoli (10 April 2014)."LibreOffice 4.2.3 is now available for download".The Document Foundation.Archivedfrom the original on 12 April 2014.Retrieved11 April2014.
  126. ^"CVE-2014-0160".LibreOffice.7 April 2014.Archivedfrom the original on 3 May 2014.Retrieved2 May2014.
  127. ^"LogMeIn and OpenSSL".LogMeIn.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  128. ^"McAfee Security Bulletin – OpenSSL Heartbleed vulnerability patched in McAfee products".McAfee KnowledgeBase.17 April 2014.Archivedfrom the original on 16 April 2014.Retrieved15 April2014.
  129. ^abcde"OpenSSL Security Bug – Heartbleed / CVE-2014-0160".Archivedfrom the original on 28 May 2014.Retrieved12 May2014.
  130. ^"Recent Version History".WinSCP.14 April 2014.Archivedfrom the original on 27 April 2014.Retrieved2 May2014.
  131. ^"Response to OpenSSL security issue CVE-2014-0160/CVE-2014-0346 a.k.a:" Heartbleed "".VMware, Inc.Archivedfrom the original on 16 April 2014.Retrieved17 April2014.
  132. ^"DSA-2896-1 openssl—security update".The Debian Project. 7 April 2014.Archivedfrom the original on 11 April 2014.Retrieved17 April2014.
  133. ^"Ubuntu Security Notice USN-2165-1".Canonical, Ltd. 7 April 2014.Archivedfrom the original on 13 April 2014.Retrieved17 April2014.
  134. ^"Important: openssl security update".Red Hat, Inc. 8 April 2014.Archivedfrom the original on 18 April 2014.Retrieved17 April2014.
  135. ^"Karanbir Singh's posting to CentOS-announce".centos.org. 8 April 2014.Archivedfrom the original on 14 April 2014.Retrieved17 April2014.
  136. ^"Amazon Linux AMI Security Advisory: ALAS-2014-320".Amazon Web Services, Inc. 7 April 2014.Archivedfrom the original on 6 June 2014.Retrieved17 April2014.
  137. ^"Android 4.1.1 devices vulnerable to Heartbleed bug, says Google".NDTV Convergence. 14 April 2014.Archivedfrom the original on 20 April 2014.Retrieved19 April2014.
  138. ^"Around 50 million Android smartphones are still vulnerable to the Heartbleed Bug".Fox News. 17 April 2014.Archivedfrom the original on 19 April 2014.Retrieved19 April2014.
  139. ^"Heartbleed: Android 4.1.1 Jelly Bean could be seriously affected".BGR Media. 16 April 2014.Archivedfrom the original on 9 March 2017.Retrieved19 April2014.
  140. ^Blaich, Andrew (8 April 2014)."Heartbleed Bug Impacts Mobile Devices".Bluebox. Archived fromthe originalon 6 May 2014.
  141. ^Snell, Jason (22 April 2014)."Apple releases Heartbleed fix for AirPort Base Stations".Macworld.Archivedfrom the original on 25 April 2020.Retrieved16 April2020.
  142. ^Kleinman, Alexis (11 April 2014)."The Heartbleed Bug Goes Even Deeper Than We Realized – Here's What You Should Do".The Huffington Post.Archivedfrom the original on 23 March 2019.Retrieved16 April2020.
  143. ^abYadron, Danny (10 April 2014)."Heartbleed Bug Found in Cisco Routers, Juniper Gear".Dow Jones & Company, Inc.
  144. ^"2014-04 Out of Cycle Security Bulletin: Multiple products affected by OpenSSL" Heartbleed "issue (CVE-2014-0160)".Juniper Networks. 14 April 2014.Archivedfrom the original on 16 April 2014.Retrieved19 April2014.
  145. ^"OpenSSL" Heartbleed "Information Disclosure, ECDSA".Electric Sheep Fencing LLC. 8 April 2014.Archivedfrom the original on 2 May 2014.Retrieved2 May2014.
  146. ^"OpenVPN affected by OpenSSL bug CVE-2014-016?".DD-WRT Forum.Archivedfrom the original on 26 February 2017.Retrieved26 February2017.
  147. ^"Heartbleed Bug Issue".Western Digital.10 April 2014. Archived fromthe originalon 19 April 2014.
  148. ^Brewster, Tom (16 April 2014)."Heartbleed: 95% of detection tools 'flawed', claim researchers".The Guardian.Guardian News and Media Limited.Archivedfrom the original on 4 March 2016.Retrieved14 December2016.
  149. ^"Tripwire SecureScan".Tripwire – Take Control of IT Security and Regulatory Compliance with Tripwire Software.Archivedfrom the original on 16 April 2014.Retrieved7 October2014.
  150. ^"AppCheck – static binary scan, from Codenomicon".Archived fromthe originalon 17 October 2014.Retrieved7 October2014.
  151. ^"Arbor Network's Pravail Security Analytics".Archived fromthe originalon 11 April 2014.Retrieved7 October2014.
  152. ^"Norton Safeweb Heartbleed Check Tool".Archivedfrom the original on 10 October 2014.Retrieved7 October2014.
  153. ^"Heartbleed OpenSSL extension testing tool, CVE-2014-0160".Possible.lv.Archivedfrom the original on 11 April 2014.Retrieved11 April2014.
  154. ^"Test your server for Heartbleed (CVE-2014-0160)".Archivedfrom the original on 11 December 2017.Retrieved25 November2014.
  155. ^"Cyberoam Security Center".Archived fromthe originalon 15 April 2014.Retrieved25 November2014.
  156. ^"Critical Watch:: Heartbleed Tester:: CVE-2014-0160".Heartbleed.criticalwatch. Archived fromthe originalon 14 April 2014.Retrieved14 April2014.
  157. ^"metasploit-framework/openssl_heartbleed.rb at master".GitHub.Archivedfrom the original on 28 June 2015.Retrieved25 November2014.
  158. ^"OpenSSL Heartbeat Vulnerability Check (Heartbleed Checker)".Archivedfrom the original on 24 December 2014.Retrieved25 November2014.
  159. ^"Heartbleed Detector: Check If Your Android OS Is Vulnerable with Our App".Lookout Mobile Security.9 April 2014.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  160. ^"Heartbleed checker".LastPass.Archivedfrom the original on 10 April 2014.Retrieved11 April2014.
  161. ^"OpenSSL Heartbleed vulnerability scanner:: Online Penetration Testing Tools | Ethical Hacking Tools".Pentest-tools.Archivedfrom the original on 13 April 2014.Retrieved11 April2014.
  162. ^Stafford, Jared (14 April 2014)."heartbleed-poc.py".Red Hat,Inc.Archivedfrom the original on 12 April 2014.Retrieved11 April2014.
  163. ^"Qualys's SSL Labs' SSL Server Test".Archivedfrom the original on 7 October 2014.Retrieved7 October2014.
  164. ^"Chromebleed".Archivedfrom the original on 18 October 2014.Retrieved7 October2014.
  165. ^"FoxBleed".Archived fromthe originalon 12 October 2014.Retrieved7 October2014.
  166. ^"SSL Diagnos".SourceForge.Archivedfrom the original on 12 October 2014.Retrieved7 October2014.
  167. ^"CrowdStrike Heartbleed Scanner".18 April 2014.Archivedfrom the original on 11 October 2014.Retrieved7 October2014.
  168. ^Lynn, Samara."Routers, SMB Networking Equipment – Is Your Networking Device Affected by Heartbleed?".PCMag.Archivedfrom the original on 24 April 2014.Retrieved24 April2014.
  169. ^"Netcraft Site Report".Archivedfrom the original on 17 August 2014.Retrieved7 October2014.
  170. ^"Netcraft Extensions".Archivedfrom the original on 11 October 2014.Retrieved7 October2014.
  171. ^Mutton, Paul (24 June 2014)."Netcraft Releases Heartbleed Indicator For Chrome, Firefox and Opera".Netcraft.Archivedfrom the original on 11 July 2014.Retrieved24 June2014.
  172. ^Mann, Jeffrey (9 April 2014)."Tenable Facilitates Detection of OpenSSL Vulnerability Using Nessus and Nessus Perimeter Service".Tenable Network Security.Archivedfrom the original on 13 April 2014.Retrieved11 April2014.
  173. ^"Nmap 6.45 Informal Release".12 April 2014.Archivedfrom the original on 17 April 2014.Retrieved23 April2014.
  174. ^"VRT: Heartbleed Memory Disclosure – Upgrade OpenSSL Now!".8 April 2014.Archivedfrom the original on 11 April 2014.Retrieved11 April2014.
  175. ^"Blogs | How to Detect a Prior Heartbleed Exploit".Riverbed. 9 April 2014.Archivedfrom the original on 19 April 2014.Retrieved19 April2014.
  176. ^"Patched Servers Remain Vulnerable to Heartbleed OpenSSL | Hayden James".Haydenjames.io. 10 April 2014.Archivedfrom the original on 13 April 2014.Retrieved10 April2014.
  177. ^"Security Certificate Revocation Awareness – Specific Implementations".Gibson Research Corporation.Archivedfrom the original on 12 May 2014.Retrieved7 June2014.
  178. ^Kerner, Sean Michael (19 April 2014)."Heartbleed SSL Flaw's True Cost Will Take Time to Tally".eWeek.Archivedfrom the original on 10 February 2020.Retrieved24 April2014.
  179. ^abcdA. Wheeler, David (29 April 2014)."How to Prevent the next Heartbleed".Archivedfrom the original on 2 February 2017.Retrieved30 January2017.
  180. ^Merkel, Robert (11 April 2014)."How the Heartbleed bug reveals a flaw in online security".The Conversation.Archivedfrom the original on 17 April 2014.Retrieved21 April2014.
  181. ^"Re: FYA: http: heartbleed".Gmane.Archived fromthe originalon 11 April 2014.Retrieved11 April2014.
  182. ^"Theo De Raadt's Small Rant On OpenSSL".Slashdot.Dice. 10 April 2014.Archivedfrom the original on 24 April 2014.Retrieved22 April2014.
  183. ^Kerner, Sean Michael (22 April 2014)."After Heartbleed, OpenSSL Is Forked Into LibreSSL".eWeek.TechnologyAdvice.Retrieved19 January2021.
  184. ^Seltzer, Larry (21 April 2014)."OpenBSD forks, prunes, fixes OpenSSL".Zero Day.ZDNet.Archivedfrom the original on 21 April 2014.Retrieved21 April2014.
  185. ^Timson, Lia (11 April 2014)."Who is Robin Seggelmann and did his Heartbleed break the internet?".The Sydney Morning Herald.Archivedfrom the original on 19 October 2017.Retrieved16 April2020.
  186. ^Williams, Chris (11 April 2014)."OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts".The Register.Archivedfrom the original on 19 September 2016.Retrieved29 August2017.
  187. ^Smith, Gerry (10 April 2014)."How The Internet's Worst Nightmare Could Have Been Avoided".The Huffington Post.Archivedfrom the original on 19 July 2017.Retrieved16 April2020.The bug revealed this week was buried inside 10 lines of code and would have been spotted in an audit, according to Laurie, who works on the security team at Google.
  188. ^abWalsh, John (30 April 2014)."Free Can Make You Bleed".SSH Communications Security.Archived fromthe originalon 2 December 2016.Retrieved11 September2016.
  189. ^Pagliery, Jose (18 April 2014)."Your Internet security relies on a few volunteers".CNNMoney.Cable News Network.Archivedfrom the original on 7 August 2020.Retrieved3 August2020.
  190. ^abcPerlroth, Nicole (18 April 2014)."Heartbleed Highlights a Contradiction in the Web".The New York Times.Archivedfrom the original on 8 May 2014.Retrieved27 February2017.
  191. ^Kaminsky, Dan (10 April 2014)."Be Still My Breaking Heart".Dan Kaminsky's Blog.Archivedfrom the original on 14 April 2014.Retrieved22 April2014.
  192. ^"Here's another way exposing Heartbleed made the Internet more secure".The Daily Dot.10 April 2014.Retrieved25 January2022.
  193. ^Chiusano, Paul (8 December 2014)."The failed economics of our software commons, and what you can about it right now".Paul Chiusano's blog.Archivedfrom the original on 6 April 2017.Retrieved3 November2017.
  194. ^ab"Amazon Web Services, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, VMware and The Linux Foundation Form New Initiative to Support Critical Open Source Projects".The Linux Foundation.24 April 2014.Archivedfrom the original on 25 April 2014.Retrieved25 April2014.
  195. ^Paul, Ian (24 April 2014)."In Heartbleed's wake, tech titans launch fund for crucial open-source projects".PC World.Archivedfrom the original on 25 April 2014.Retrieved24 April2014.
  196. ^"Google Project Zero aims to keep the Heartbleed Bug from happening again".TechRadar.15 July 2014.Archivedfrom the original on 10 April 2017.Retrieved9 April2017.
  197. ^Greenberg, Andy (15 July 2014)."Meet 'Project Zero,' Google's Secret Team of Bug-Hunting Hackers".Wired.ISSN1059-1028.Retrieved6 March2019.

Bibliography

[edit]
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Heartbleed&oldid=1232786628"