HeartBleed OpenSSL Bug
The OpenSSL cryptographic software library have a serious vulnerability called HeartBleed. This vulnerability cause the internet connection insecure because it was using the SSL/TLS encryption, the information can be easily stoled by thirds party.
Almost all internet application of the security communication and privacy over the internet is using SSL/TLS. This weakeness will cause the application like web, email, instant messaging,and some Virtual Private networks being compromise.
Heartbleed bug is allows anyone on the internet to read the memory of the systems protected by the vulnerable version of the OpenSSL software. This cause the secret keys that identify the services providers and to encrypt the traffic, important information like names, passwords of the users and it content being compromises. Hackers able to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users. What leaks in practice? We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.
Almost all internet application of the security communication and privacy over the internet is using SSL/TLS. This weakeness will cause the application like web, email, instant messaging,and some Virtual Private networks being compromise.
Heartbleed bug is allows anyone on the internet to read the memory of the systems protected by the vulnerable version of the OpenSSL software. This cause the secret keys that identify the services providers and to encrypt the traffic, important information like names, passwords of the users and it content being compromises. Hackers able to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users. What leaks in practice? We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.
Comments
Post a Comment