+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: heartbleed bug core (/Thread-heartbleed-bug-core)
Pages:
1
2
heartbleed bug core - White_Hat1984 - 06-19-2014
How is heartbleed made? If I can better understand it. I can better protect against it
RE: heartbleed bug core - RaccoonCity_mybb_import13707 - 06-19-2014
Uhm, I mean.
As long as you don't have a website, or use OpenSSL 1.0.1 which is the vulnerable version of OpenSSL you're fine.
I don't really get what you're asking for. Are you asking how to exploit it or how it works?
RE: heartbleed bug core - BlueCat - 06-19-2014
(06-19-2014, 03:42 PM)RaccoonCity Wrote: Uhm, I mean.
As long as you don't have a website, or use OpenSSL 1.0.1 which is the vulnerable version of OpenSSL you're fine.
I don't really get what you're asking for. Are you asking how to exploit it or how it works?
I think he's asking how did it first come about, What caused it etc
RE: heartbleed bug core - RaccoonCity_mybb_import13707 - 06-19-2014
(06-19-2014, 03:43 PM)BlueCat Wrote:(06-19-2014, 03:42 PM)RaccoonCity Wrote: Uhm, I mean.
As long as you don't have a website, or use OpenSSL 1.0.1 which is the vulnerable version of OpenSSL you're fine.
I don't really get what you're asking for. Are you asking how to exploit it or how it works?
I think he's asking how did it first come about, What cause it etc
Oh
RE: heartbleed bug core - BlueCat - 06-19-2014
(06-19-2014, 08:50 AM)White_Hat1984 Wrote: How is heartbleed made? If I can better understand it. I can better protect against it
This shall give you a good understanding.
http://www.cbc.ca/news/technology/heartbleed-web-security-bug-what-you-need-to-know-1.2603988
RE: heartbleed bug core - alok9shm - 06-19-2014
(06-19-2014, 03:42 PM)RaccoonCity Wrote: Uhm, I mean.
As long as you don't have a website, or use OpenSSL 1.0.1 which is the vulnerable version of OpenSSL you're fine.
If you don't have a website or don't use OpenSSL 1.0.1, you should still be worried. Maybe you have registered an account on a website and That website is vulnerable to the HB bug, then your account credentials are at risk. Isn't it?
RE: heartbleed bug core - Anima Templi - 06-19-2014
For SSL to work, your computer needs to communicate to the server via sending 'heartbeats' that keep informing the server that client (computer) is online (alive).
Heartbleed attack allows an attacker to retrieve a block of memory of the server up to 64kb in response directly from the vulnerable server via sending the malicious heartbeat and there is no limit on the number of attacks that can be performed.
It opens doors for the cyber criminals to extract sensitive data directly from the server's memory without leaving any traces.
RE: heartbleed bug core - RaccoonCity_mybb_import13707 - 06-19-2014
(06-19-2014, 04:05 PM)alok9shm Wrote:(06-19-2014, 03:42 PM)RaccoonCity Wrote: Uhm, I mean.
As long as you don't have a website, or use OpenSSL 1.0.1 which is the vulnerable version of OpenSSL you're fine.
If you don't have a website or don't use OpenSSL 1.0.1, you should still be worried. Maybe you have registered an account on a website and That website is vulnerable to the HB bug, then your account credentials are at risk. Isn't it?
Yeah, I guess you're right.
RE: heartbleed bug core - Anima Templi - 06-19-2014
Pretty much every major website out there, which was affected by Heartbleed, has been patched. The massive media cover of the whole situation made it very hard, not to patch it.
RE: heartbleed bug core - White_Hat1984 - 06-19-2014
(06-19-2014, 04:08 PM)Anima Templi Wrote: For SSL to work, your computer needs to communicate to the server via sending 'heartbeats' that keep informing the server that client (computer) is online (alive).
Heartbleed attack allows an attacker to retrieve a block of memory of the server up to 64kb in response directly from the vulnerable server via sending the malicious heartbeat and there is no limit on the number of attacks that can be performed.
It opens doors for the cyber criminals to extract sensitive data directly from the server's memory without leaving any traces.
That was helpful thank you