Heartbleed : Serious OpenSSL zero day vulnerability revealed

Pour l’extension à l’origine de la faille : ▻http://seenthis.net/messages/56010

Pour tester vos serveurs Web (mais attention, la faille ne concerne pas que HTTPS) : ▻http://seenthis.net/messages/245091

Un article détaillé d’analyse, qui est sceptique quant à la gravité de la faille ▻http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html

Le patch lui-même ▻https://github.com/openssl/openssl/commit/96db9023b881d7cd9f379b0c154650d6c108e9a3

Un exemple de l’utilisation de la faille pour voler des mots de passe, chez Yahoo : ▻https://twitter.com/markloman/status/453502888447586304

L’avis (très court et pas très utile) du CERT gouvernemental français : ▻http://www.cert.ssi.gouv.fr/site/CERTFR-2014-ALE-003/index.html

Comment se servir de HeartBleed pour voler des cookies et les manger (non, je rigole, pour se loguer à la place de l’utilisateur légitime) ▻https://www.michael-p-davis.com/using-heartbleed-for-hijacking-user-sessions

Et bien sûr du #XKCD ▻http://xkcd.com/1353

Une liste de liens plutôt intéressante
▻http://blogs.gnome.org/markmc/2014/04/10/heartbleed

comme :
– le patch à l’origine de la faille, commité pendant le réveillon de la nouvelle année 2012. ▻http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4817504

– la réalisation de la place critique d’openSSL dans l’architecture du net, même là où on ne l’attendait pas ▻http://www.troyhunt.com/2014/04/everything-you-need-to-know-about.html

How our perception of a vulnerability like this has changed now that we know just how aggressive intelligence agencies (the NSA and others) are in their approach to population surveillance and monitoring. This FOSDEM talk is rather prescient in describing OpenSSL as the “crown jewels” for the NSA.
▻http://ftp.belnet.be/FOSDEM/2014/Janson/Sunday/NSA_operation_ORCHESTRA_Annual_Status_Report.webm

Comme 50 % du travail d’un chercheur en sécurité, aujourd’hui, se passe à trouver un nom qui claque pour la vulnérabilité découverte, celle-ci est « le cœur qui saigne ».

Et ils s’en félicitent: ▻http://www.kalzumeus.com/2014/04/09/what-heartbleed-can-teach-the-oss-community-about-marketing

I want to take a moment to point at the marketing aspects of it: how the knowledge about Heartbleed managed to spread within a day and move, literally, hundreds of thousands of people to remediate the problem.

Heartbleed is much better marketed than typical for the OSS community, principally because it has a name, a logo, and a dedicated web presence.

Bruce Schneier
▻https://www.schneier.com/blog/archives/2014/04/heartbleed.html

Mashable lists some popular affected sites who suggest changing your password
▻http://mashable.com/2014/04/09/heartbleed-bug-websites-affected

*Google said users do not need to change their passwords, but because of the previous vulnerability, better safe than sorry.

Buzzfeed
The Real Threat From The Heartbleed Security Flaw Is The NSA
▻http://www.buzzfeed.com/charliewarzel/the-nsa-and-the-real-problem-behind-the-heartbleed-security

Yeah !
►http://filippo.io/Heartbleed

All good, monserveur .de seems fixed or unaffected!

thx anyway :-)

Heartbleed disclosure timeline: who knew what and when
▻http://www.smh.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140415-zqurk.html

Tuesday, April 1: Google Security notifies OpenSSL about the flaw it has found in OpenSSL, which later becomes known as “Heartbleed”. Mark Cox at OpenSSL says the following on social network Google Plus: “Original plan was to push [a fix] that week, but it was postponed until April 9 to give time for proper processes.” Google tells OpenSSL, according to Cox, that they had “notified some infrastructure providers under embargo”. Cox says OpenSSL does not have the names of providers Google told or the dates they were told. Google declined to tell Fairfax which partners it had told. “We aren’t commenting on when or who was given a heads up,” a Google spokesman said.

Saturday, April 5 15:13 - Codenomicon purchases the Heartbleed.com domain name, where it later publishes information about the security flaw.