Heartbleed openssl bug (private keys at risk)
 

Heartbleed openssl bug (private keys at risk)

http://heartbleed.com/
http://arstechnica.com/security/2014...eavesdropping/
http://threatpost.com/seriousness-of...sets-in/105309

OpenSSL is default for apache and nginc, 66% of web sites.

"A missing bounds check allows an attacker to read up to 64 KB of memory on a machine protected by OpenSSL."

"Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption."

Test your server:

http://filippo.io/Heartbleed/

fucking god dammit :mad:

patched this/rebooted a few hours ago :thumbsup

jesus what a bug, how the fuck they just found it now

Webmasters can test their site here: filippo.io

The NSA must be falling all over themselves to try to find as many vulnerable servers as possible so they can finally decipher that mystery encrypted data they've been capturing all this time.

... assuming they only found out about it 2 days ago, like the rest of us, rather than 2 years ago when the bug first appeared in the source code...

It could well be that NSA knew the exploit since a year and it is upset that it was found and patched.

That's easy... company that found the bug has connections to Google, Obama, DHS, and FBI. Funny how a company with those ties found a bug that seems to beg for government intervention

already updated my servers