Upcoming Events

International | Sci-Tech

no events match your query!

New Events

International

no events posted in last week

User Preferences

  • Language - en | ga
  • text size >>
  • make this your indymedia front page make this your indymedia front page

Blog Feeds

The Saker
A bird's eye view of the vineyard

offsite link Moveable Feast Cafe 2016/09/30 ? Open Thread Fri Sep 30, 2016 08:30 | Herb Swanson
2016/09/30 07:30:01Welcome to the ‘Moveable Feast Cafe’. The ‘Moveable Feast’ is an open thread where readers can post wide ranging observations, articles, rants, off topic and have animate discussions of

offsite link The war against Syria: both sides go to ?plan B? Fri Sep 30, 2016 05:30 | The Saker
This article was written for the Unz Review: http://www.unz.com/tsaker/the-war-aga... In view of the total failure the US policy to regime-change Syria and overthrow Assad, the time has now come for

offsite link The Debate ? Winning by Losing Thu Sep 29, 2016 15:43 | Saker-Admin
The presidential debate has generated a lot of comments here on thesaker.is. The moderators have read many different views. The moderators all found this comment by  TooLegit2Quit well worth reading, it

offsite link Syrian War Report ? September 29, 2016: US Deploys Troops near Aleppo City Thu Sep 29, 2016 14:17 | The Saker
https://southfront.org/syrian-war-rep...

offsite link A beautiful situation in Syria or how to build a mousetrap, by Cat Motya Thu Sep 29, 2016 04:11 | Scott
A beautiful situation in Syria or how to build a mousetrap,  by Cat Motya The US, Russia and SYRIA SitRep by Cat Motya, September 27, 2016 Russia, US and Syria

The Saker >>

Human Rights in Ireland
www.humanrights.ie

offsite link Benefit Sanctions and Coercion Within the Irish Welfare System Thu Sep 22, 2016 13:38 | Cliodhna Murphy

offsite link The rights of the unborn: a troubling decision from the High Court? Wed Aug 10, 2016 12:42 | Máiréad Enright

offsite link Progress Report on the Northern/Irish Feminist Judgments Project. Mon Jul 11, 2016 13:40 | admin

offsite link The UN and the Eighth Amendment Thu Jun 23, 2016 09:46 | admin

offsite link Call for Papers: State Accountability for Vulnerability Mon Jun 20, 2016 12:29 | admin

Human Rights in Ireland >>

Cedar Lounge
For lefties too stubborn to quit

offsite link The most deadly species of them all! 11:58 Sat Oct 01, 2016 | WorldbyStorm

offsite link This Weekend I?ll Mostly Be Listening to? Kristin Hersh 08:56 Sat Oct 01, 2016 | WorldbyStorm

offsite link A Miracle in Ballymore ? last evening Saturday October 1st 22:08 Fri Sep 30, 2016 | WorldbyStorm

offsite link Crisis? What Crisis? Well? perhaps a hard border crisis. 12:23 Fri Sep 30, 2016 | WorldbyStorm

offsite link CONFERENCE: IRELAND & THE SPANISH REPUBLIC 11:40 Fri Sep 30, 2016 | WorldbyStorm

Cedar Lounge >>

Dublin Opinion
Life should be full of strangeness, like a rich painting

offsite link Notes for a Book on Money and the Irish State - The Marshall Aid Program 15:10 Sat Apr 02, 2016

offsite link The Financial Crisis:What Have We Learnt? 19:58 Sat Aug 29, 2015

offsite link Money in 35,000 Words or Less 21:34 Sat Aug 22, 2015

offsite link THE WRATH OF KANE: BANKING CRISES AND POLITICAL POWER 09:32 Fri Jan 30, 2015

offsite link ALWAYS THE ARTISTS: WEEK THREE OF THE BANK INQUIRY 23:11 Thu Jan 22, 2015

Dublin Opinion >>

The latest HEARTBLEED OpenSSL bug

category international | sci-tech | news report author Friday April 11, 2014 09:43author by wageslave Report this post to the editors

The false sense of security of the internet has been completely overturned by the latest security bug to be discovered. A bug in the popular OpenSSL library used by many of the most important and frequently used server sites on the net allows arbitrary chunks of memory to be read remotely from user machines and servers, possibly containing very sensitive data, user tokens, bank details, emails and passwords. What does all this mean and how did it happen and what can we do to protect ourselves?

heartbleed.png

The latest security hole to rock the internet in the wake of the Snowden revelations is pretty huge. A bug in the OpenSSL library means that client computers can read arbitrary chunks of memory from servers all over the internet. Apparently this has been the case for the last two years.

For those who don't understand what this means, an SSL library is being used whenever you see that padlock icon appear in the address area of your browser. This usually happens when you are connecting to a website which requires some privacy such as your banking site or your webmail or other such servers.

To put this in perspective, about 66% of internet servers use a particular OpenSSL library to manage these sensitive connections with their clients.

So what is the problem?
ok the problem is this. When your computer connects to a server using this OpenSSL library, your computer and the server have a protocol called a "heartbeat" whereby they exchange a bit of data back and forth at regular intervals to maintain the connection. If this heartbeat stops, the connection is closed. Makes sense. However an error was introduced in the code used in this process (Rather suspiciously it was on new years eve, December 31 2011, when few people were looking. ).

The error was as follows:
in order to maintain the heartbeat, crucially, the client sends a few pieces of data to the server
heartbeat_type, pl, payload

where heartbeat_type defines the information structure to be used,
pl is the length of "payload" in bytes
and "payload" is some arbitrary piece of data.

once the server gets this data, it temporarily stores the "payload" data in its memory somewhere.
It then uses the software function memcopy(bp,pl,payload) to copy this data into a suitably formatted data packet to transmit back to the client.

The client then receives the packet, and it knows the server is alive, the two computers communicate for a bit, or not as the case may be, then the heartbeat process is repeated again after a suitable interval. And so on until the client disconnects from the server

ok that all sounds fine. Or it would be assuming the client was not malicious. Because it turns out the client can "lie" to the server when setting up this heartbeat data. The client can pretend the payload is much larger than it actually is because as you may have noticed, the client sends both the length of the payload and the payload itself to the server. And crucially, the server does NOT check the length is actually correct. This is the crux of the problem. A "buffer underrun"

So if a malicious client connects to the server and sends a false length of "64K" (the largest size it will accept) but only sends one "byte" in the payload, then the server dutifully sends back 64k of data.

Now out of the 64k sent back by the server, only 1k is actually our original payload. So what exactly is in the rest of this data packet returned from our server? This is a very good question!. The answer is whatever was in the memory of the server adjacent to where it temporarily stored our payload. This could be absolutely anything. Security certificates, Passwords, IP addresses, emails, user security tokens, anything.
And if you stay connected to the server, you can do this all night until something juicy comes back in the response from the server.
No doubt you can see the problem now.

A malicious server can also do the same thing to any client that connects to it.

Was it intentional?
At the moment it is not clear whether it was malicious. However if you have been keeping up with the Edward Snowden revelations, you will know that the NSA are up to all sorts of tricks to get your information, and this one is basically an open door for them to read the memory of 66% of internet servers. This includes many of the top services we all use on a regular basis. They could also compromise anyone they can trick into connecting to one of their servers too. A tactic the Snowden leaks show that they do use. It's all certainly very suspicious, and the timing of this code change is particularly suspicious in my book. it looks like it may have been used to monitor IRC traffic which is where the likes of anonymous would be hanging out.
https://www.eff.org/deeplinks/2014/04/wild-heart-were-i...-2013

What should I do to protect myself?
It is suggested that you update your OS if you are using any of the flavours of linux which are using the compromised library version.
(OpenSSL versions 1.0.1 through 1.0.1f (inclusive) are vulnerable )
this ships with the following versions of linux:

Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
CentOS 6.5, OpenSSL 1.0.1e-15
Fedora 18, OpenSSL 1.0.1e-4
OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
NetBSD 5.0.2 (OpenSSL 1.0.1e)
OpenSUSE 12.2 (OpenSSL 1.0.1c)

Update to OpenSSL version 1.0.1g as soon as you can through the usual system updating procedures for linux

Apple say their OSX is safe but if you are using OSX mavericks, they recommend updating to 10.9.2 just to be safe. Some free programs may use the library so they will need updating

Windows is not affected according to microsoft, although some free programs may use the OpenSSL library and they will need updating.

Alas, that is not the end of it. The bug has been in the wild for two years. There is always the possibility that your passwords etc may have been compromised on many of the internet servers you use. It is recommended you change all your passwords on the internet services you use.

It is highly recommended you wait until these servers have updated their security certificates and replaced any compromised SSL code on their servers and given the all clear before you log on and change your passwords

You should check out this site for some helpful information on some of the main sites, but it is by no means a full list:
http://mashable.com/2014/04/09/heartbleed-bug-websites-...cted/

The official site for information is here:
http://heartbleed.com/

For those of you who are a bit more technically minded, there is a good analysis here:
http://blog.existentialize.com/diagnosis-of-the-openssl....html

A simpler explanation here:
http://gizmodo.com/how-heartbleed-works-the-code-behind...41209

© 2001-2016 Independent Media Centre Ireland. Unless otherwise stated by the author, all content is free for non-commercial reuse, reprint, and rebroadcast, on the net and elsewhere. Opinions are those of the contributors and are not necessarily endorsed by Independent Media Centre Ireland. Disclaimer | Privacy