ElkArte Community

Project Support => General ElkArte discussions => Topic started by: emanuele on April 14, 2014, 12:24:06 pm

Title: Why not talk about heartbleed! :P
Post by: emanuele on April 14, 2014, 12:24:06 pm
I suppose you have heard about it already (OpenSSL bug, if you haven't just google it in your preferred language and you'll get plenty of results).

Github was affected too:
https://github.com/blog/1818-security-heartbleed-vulnerability
they suggest:
Quote1. Change your GitHub password.
2. Enable Two-Factor Authentication.
3. Revoke and recreate personal access and application tokens.

I suppose I have to do that, right? meh...
Title: Re: Why not talk about heartbleed! :P
Post by: Runic on April 15, 2014, 08:29:32 am
came up in a pub quiz I was at last night my team was only one to get it correct :D
Title: Re: Why not talk about heartbleed! :P
Post by: Spuds on April 15, 2014, 09:37:02 am
Quote from: emanuele – I suppose I have to do that, right? meh...
I'd think so.  Before sites closed the hole it was amazing to see what you could get from the server memory and with almost no effort.  I guess the real issue is, no one really knows how long it may have been exploited.  The issue was around for, what 2 years, and if anyone knew about it they could have amassed quite the tasty mountain of info.
Quote from: TrayBake – came up in a pub quiz I was at last night my team was only one to get it correct :D
Awesome  :D
Title: Re: Why not talk about heartbleed! :P
Post by: emanuele on April 15, 2014, 05:44:09 pm
Changed everything!
Now I should do the same with the various google accounts...

/me is scared and annoyed already... lol
Title: Re: Why not talk about heartbleed! :P
Post by: meetdilip on April 16, 2014, 06:00:42 pm
How can we find if a site is affected or not. Any simple way like putting our URL as in Google PR check ?
Title: Re: Why not talk about heartbleed! :P
Post by: Spuds on April 16, 2014, 06:28:50 pm
You can use https://filippo.io/Heartbleed/ and enter a URL to see if its effected.  Most of the large sites fixed it within hours of it being published.   There was a running list of the top 1000+ sites for vulnerability published which put some extra pressure on them to plug the hole.  :P
Title: Re: Why not talk about heartbleed! :P
Post by: Jokerâ„¢ on April 17, 2014, 09:25:18 am
Ahhh guys, I made some replies over SMF for heartbleed bug and here's the crux of it

This article (http://www.phpclasses.org/blog/post/231-OpenSSL-Serious-Security-Bug-Does-it-Affect-Your-PHP-sites.html) seems pretty relevant. Moreover there is a tool link (https://www.ssllabs.com/ssltest/analyze.html) in it to check the ssl security.

If anyone interested in reading, a bit more detailed explanation in terms of technicality about heartbleed is mentioned over
here (http://www.troyhunt.com/2014/04/everything-you-need-to-know-about.html).

Here (http://www.theverge.com/us-world/2014/4/11/5606524/hacker-successfully-uses-heartbleed-to-retrieve-private-security-keys) is about what can be done via exploiting the bug.

I'm still not sure why everyone is changing there passwords, as until a site fixes the server, changing password is still a waste of energy.