Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 12 Apr 2014 06:33:13 +0000
From: mancha <mancha1@...o.com>
To: oss-security@...ts.openwall.com
Subject: Re: Cauterizing OpenSSL's heartbleed (the aftermath)

On Wed, Apr 09, 2014 at 04:20:14PM -0700, Seth Arnold wrote:
> On Wed, Apr 09, 2014 at 10:47:48PM +0000, mancha wrote:
> > Mustafa Al-Bassam's work assists a great deal with this taxonomy. He
> > ran PoC code against Alexa top 100, 1000, and 10000 sites beginning
> > about 18 hours after OpenSSL's first public announcement [1].
> > 
> > Specifically, his scans began circa: 1396956600 (top 100); 1396958400
> > (top 1000); and 1396972800 (top 10000). Did any major vendors deploy
> > upgrades prior to this?
> 
> Ubuntu's updates were released around 1396907296 [2], roughly 13 hours
> before Mustafa's awesome scans.
> 
> Thanks
> 
> > [1] https://github.com/musalbas/heartbleed-masstest
> 
> [2] https://launchpad.net/ubuntu/+source/openssl/+publishinghistory

Thanks Seth (and Yves-Alexis) and kudos on the very fast reaction times.

Unfortunately for this exercise, your efficiency waters down the meaning
of "not vulnerable" in Mustafa's scans. His "vulnerable" category is
still of value, though. Maybe scans closer to time-zero will pop up.

FYI, there is confirmation of private key compromise (aside from
Codenomicon's):

https://www.cloudflarechallenge.com/heartbleed

--mancha


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ