Thanks Vic. I had only been reading all I could about this this arvo. It gets more confusing the more I read.
I would ask that any of the "techo pooter gurus" on here give we 'ordinary folk' a 'translation' of the advice being bandying around.
For instance, I provide this from the ABC article posted -
"There is nothing users can do to fix their computers," Mikko Hypponen, chief research officer with security software maker F-Secure of Helsinki, said.
"They have to rely on the administrators of the websites they use."
Fox-IT estimates the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.
OpenSSL is used by more than half of all websites, but not all versions have the vulnerability, according to heartbleed.com.
I understand that changing passwords immediately may not be any use either, as it is dependent on whether 'web administrators' have 'updated' OpenSSL to the new 'clean' version. If we change passwords now, we will need to change them again after the web admins update.
Sounds damned annoying and messy. The other confusing thing is this "virus" has been in the OpenSSL software on services for "at least two years". One would assume any 'damage', or 'theft', has already happened. As an ill-informed user of pooters, I just get annoyed.
Hopefully, some well-knowledged pooter guru on this forum can give us some informed advice.
cheers - John
Vic41 said
04:54 PM Apr 10, 2014
rockylizard wrote:
Gday...
Thanks Vic. I had only been reading all I could about this this arvo. It gets more confusing the more I read.
I would ask that any of the "techo pooter gurus" on here give we 'ordinary folk' a 'translation' of the advice being bandying around.
For instance, I provide this from the ABC article posted -
"There is nothing users can do to fix their computers," Mikko Hypponen, chief research officer with security software maker F-Secure of Helsinki, said.
"They have to rely on the administrators of the websites they use."
Fox-IT estimates the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.
OpenSSL is used by more than half of all websites, but not all versions have the vulnerability, according to heartbleed.com.
I understand that changing passwords immediately may not be any use either, as it is dependent on whether 'web administrators' have 'updated' OpenSSL to the new 'clean' version. If we change passwords now, we will need to change them again after the web admins update.
Sounds damned annoying and messy. The other confusing thing is this "virus" has been in the OpenSSL software on services for "at least two years". One would assume any 'damage', or 'theft', has already happened. As an ill-informed user of pooters, I just get annoyed.
Hopefully, some well-knowledged pooter guru on this forum can give us some informed advice.
cheers - John
Because it is such a concern to those on the road John, I thought it was best putting it here where most will see it.
Does make you wonder though as you say it has been around so long already, hope they get it sorted soon for everyone.
Cloak said
05:06 PM Apr 10, 2014
Oh no not another Linux / Unix / Macos hook.
Joe50 said
12:14 AM Apr 11, 2014
Have just listened to an explanation of the OpenSSL problem on a security podcast I subscribe to, although it's still a bit techie for me. Here's what I understand:
1. Any attack on a vulnerable server will leave no trace in the server's logs. 2. It allows an attacker to obtain a 64kb chunk of memory from the server, which could contain the keys for encryption certificates, logins & passwords, and other data. 3. Servers running OpenSSL on various flavours of Linux distributions including Debian, Ubuntu and Fedora, as well as OpenBSD and FreeBSD, are vulnerable. Servers using Microsoft's IIS are not affected. 4. The Big Four banks are not vulnerable to the exploit (you can test the overall quality of a server's SSL capabilities by going to https://www.ssllabs.com/ssltest/ and typing in the site's domain name. They've just added a test for this vulnerability.
Linux and Unix grounded early in security and then lived on in a bubble of well-being .. methinks the bubble has burst, eh wot !
native pepper said
07:43 AM Apr 11, 2014
It's a vulnerability in the code, when you log onto a supposed secure site if your server is using a particular version of open ssl (only used by apple, chrome and microsoft) then they can easily work out and bypass the security encryption and have access to all your data as you use it over time. The may not have the ability to hack you account, but take you data when you log in and are using it.
This has been know in the linux community for a long time and was fixed early last year, so linux users who get constant updates of all open source they use, only lacked protection for a couple of days a year or so ago.
Anyone wonder why suddenly as soon as windows stops supporting xp, this vulnerability suddenly appears, when microsoft, apple, google, have known about it for at least the last year and done nothing.
dING said
08:21 AM Apr 11, 2014
Tis like all things humam
If someone can make a $
Out of it they will some smart
Buggas out there
dorian said
08:24 AM Apr 11, 2014
native pepper wrote:
This has been know in the linux community for a long time and was fixed early last year ...
I checked the changelogs for previous releases of OpenSSL, but I can't find (or recognise?) any reference to a related fix in releases prior to 1.1.0.
Note: I have included Google's cached versions of both web pages.
Patches for it have been available for a long time and it was only in the beta release on microsoft, apple and google servers. To the best of my knowledge, dedicated linux servers don't use beta releases as they tend to be buggy and a bit unstable, plus they have extra security measures available to them, but proprietary users don't have the ability to oversee and act on their security as we are seeing with this vulnerability.
When you can take 64k every log in, it's not rocket science to realise it wouldn't be very long before you had all information you need to hack, use DSS, or compromise accounts and services. Vulnerable systems are those which you have no control over the security system, ports or code, so have to rely upon companies to provide them at their pleasure and when profit is the only desired outcome, you get what they give you.
Your link shows this is the case. https://www.openssl.org/news/secadv_20140407.txt
dorian said
10:00 AM Apr 11, 2014
What the Security Advisory page is saying to me is that the following versions were vulnerable to the "TLS heartbeat read overrun" exploit:
1.0.1f 1.0.2-beta1
The same vulnerability was not present in 1.0.1g and 1.0.2-beta2.
However, ISTM that the absence of the vulnerability in current releases may be coincidental rather than the result of a targeted fix, otherwise why would the advisory state the following:
"Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl at chromium dot org> and Bodo Moeller <bmoeller at acm dot org> for preparing the fix."
-- Edited by dorian on Friday 11th of April 2014 10:01:21 AM
rockylizard said
10:16 AM Apr 11, 2014
rockylizard wrote:
Gday...
Thanks Vic. I had only been reading all I could about this this arvo. It gets more confusing the more I read.
I would ask that any of the "techo pooter gurus" on here give we 'ordinary folk' a 'translation' of the advice being bandying around.
~~~
Hopefully, some well-knowledged pooter guru on this forum can give us some informed advice.
cheers - John
Gday...
The back and forth banter and flexing of 'technology muscle' is baffling - rather than helping 'ordinary folk' to know how - or indeed, whether - to respond to this 'virus'.
I retiterate my earlier plea bolded above.
Perhaps the "red haired quote" applies here ... Please Explain.
Cheers - John
-- Edited by rockylizard on Friday 11th of April 2014 10:17:34 AM
native pepper said
10:43 AM Apr 11, 2014
dorian wrote:
What the Security Advisory page is saying to me is that the following versions were vulnerable to the "TLS heartbeat read overrun" exploit:
1.0.1f 1.0.2-beta1
The same vulnerability was not present in 1.0.1g and 1.0.2-beta2.
However, ISTM that the absence of the vulnerability in current releases may be coincidental rather than the result of a targeted fix, otherwise why would the advisory state the following:
"Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl at chromium dot org> and Bodo Moeller <bmoeller at acm dot org> for preparing the fix."
-- Edited by dorian on Friday 11th of April 2014 10:01:21 AM
There is a huge difference between what proprietary software providers do about their security and what others do. Our major banks fixed this last year, because it was known about back then. Our web site (linux servers) provider, notified us last year they had patched it long ago. The forum I moderate on has linux servers and it was the same with them, fixed it long ago.
You only have to look at the track record of proprietary companies and their approach to security to know they only close vulnerabilities when they become a concern to their customers, who start complaining and gets into the social side of the web. Much of their profit growth is derived from supplying users data to other companies, so they can use it to troll customers on line. Then we have the huge profits they make out of anti virus software, when in reality if the system was a modern decent one, the user would have full control and the ability to block any attack.
This is the 21st century and the only secure systems are open source, windows is wide open as is apple and chrome, they are just a sponges for absorbing peoples data and personal details, which they sell on the open market to any who will pay up. Where do people think all the spam they get comes from, we rarely ever get spam, because we use anonymous proxies and deep web facilities.
Call it scaremongering if you like, as the deniers here certainly will. They've done it in the past, but what I posted earlier about what microsoft will do to force people from earlier versions of windows to last century win8, is happening.
Many others fixed this long ago, only google, apple and microsoft servers have done nothing about it until now when it finally leaked out there was a deliberate vulnerability added, to assist in data mining collection for controlling corporations. That's the situation and always will be as long as profit growth systems are what people lock themselves into, if you read the terms of use, you will soon realise they can take all the data they want from you any time they want and there's nothing you can do about it. No such problems with open course, you own your system and have as much control over it as you want.
"OpenSSL 1.0.1g packages are now available via Anaconda. These packages patch the “heartbleed” vulnerability described in CVE-2014-0160.
Versions Affected
Vulnerable OpenSSL versions are those from 1.0.1 to 1.0.1f inclusive. Version 1.0.1g and forward contain the fix. Other versions of OpenSSL not in the 1.0.1 release branch, such as 1.0.0 or 0.9.8 are not vulnerable."
ISTM that the "heartbleed" vulnerability was present in all official 1.0.1 releases until the release of 1.0.1g a few days ago. Therefore the 1.0.1g heartbleed bugfix was a targeted fix, not an accidental one. I don't know which bugfix you are referring to, but the only times that "heartbeat" is mentioned in the changelogs is the reference to the recently discovered problem and a reference to the introduction of support for "TLS/DTLS heartbeats" on 14 March 2012. The Google Security Team were cited several times for reporting various bugs (19 Apr 2012, v1.0.1a, 1.0.0i, 0.9.8v), but only once in relation to the heartbeat issue.
Roving-Dutchy said
01:45 PM Apr 11, 2014
rockylizard wrote:
rockylizard wrote:
Gday...
Thanks Vic. I had only been reading all I could about this this arvo. It gets more confusing the more I read.
I would ask that any of the "techo pooter gurus" on here give we 'ordinary folk' a 'translation' of the advice being bandying around.
~~~
Hopefully, some well-knowledged pooter guru on this forum can give us some informed advice.
cheers - John
Gday...
The back and forth banter and flexing of 'technology muscle' is baffling - rather than helping 'ordinary folk' to know how - or indeed, whether - to respond to this 'virus'.
I retiterate my earlier plea bolded above.
Perhaps the "red haired quote" applies here ... Please Explain.
Cheers - John
-- Edited by rockylizard on Friday 11th of April 2014 10:17:34 AM
Now after reading all the posts, I'm even more confused than previously, can someone explain in other than techno babble, if we need to do something and don't come back with the answer you should be using Linux.
Cheers
David
native pepper said
02:29 PM Apr 11, 2014
G'day David, there's nothing you can do, as the problem is not with your computer but the servers you use on the net. Doesn't matter if you use linux, windows or os1, it depends on what the serves you go through use and how good their security encryption is. There is now much better encryption software, which doesn't have the vulnerabilities of the couple of open SSl releases. Fixing it is extremely simple and one would expect it to be already done within most servers.
It's data on un-updated servers which are vulnerable, doesn't matter what computer system you are using. There is no advantage in this case with using any system, you can change passwords, but most sites which require good encryption would have overcome the problem already with patches and the majority of linux user servers did that last year. If a windows server uses the vulnerable versions of open ssl, they will have the same problem, on our home server, we use a couple a specialised encryption between the server and our 3 stations which runs on Kali linux which is a dedicated security distro.
rockylizard said
03:30 PM Apr 11, 2014
Gday...
Some further information on what "we ordinary folk" should perhaps do ...
This is a genuine virus affecting internet systems/pc's etc, see;
http://www.abc.net.au/news/2014-04-10/heartbleed-bug-password-reset-data-openssl/5379604
See also snopes;
http://www.snopes.com/computer/virus/heartbleed.asp
Gday...
Thanks Vic. I had only been reading all I could about this this arvo. It gets more confusing the more I read.
I would ask that any of the "techo pooter gurus" on here give we 'ordinary folk' a 'translation' of the advice being bandying around.
For instance, I provide this from the ABC article posted -
"There is nothing users can do to fix their computers," Mikko Hypponen, chief research officer with security software maker F-Secure of Helsinki, said.
"They have to rely on the administrators of the websites they use."
Fox-IT estimates the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.
OpenSSL is used by more than half of all websites, but not all versions have the vulnerability, according to heartbleed.com.
I understand that changing passwords immediately may not be any use either, as it is dependent on whether 'web administrators' have 'updated' OpenSSL to the new 'clean' version. If we change passwords now, we will need to change them again after the web admins update.
Sounds damned annoying and messy. The other confusing thing is this "virus" has been in the OpenSSL software on services for "at least two years". One would assume any 'damage', or 'theft', has already happened. As an ill-informed user of pooters, I just get annoyed.
Hopefully, some well-knowledged pooter guru on this forum can give us some informed advice.
cheers - John
Because it is such a concern to those on the road John, I thought it was best putting it here where most will see it.
Does make you wonder though as you say it has been around so long already, hope they get it sorted soon for everyone.
Have just listened to an explanation of the OpenSSL problem on a security podcast I subscribe to, although it's still a bit techie for me. Here's what I understand:
1. Any attack on a vulnerable server will leave no trace in the server's logs.
2. It allows an attacker to obtain a 64kb chunk of memory from the server,
which could contain the keys for encryption certificates, logins & passwords,
and other data.
3. Servers running OpenSSL on various flavours of Linux distributions including Debian,
Ubuntu and Fedora, as well as OpenBSD and FreeBSD, are vulnerable. Servers using
Microsoft's IIS are not affected.
4. The Big Four banks are not vulnerable to the exploit (you can test the overall
quality of a server's SSL capabilities by going to https://www.ssllabs.com/ssltest/
and typing in the site's domain name. They've just added a test for this vulnerability.
.. oh dear ! .. remember simplicity .. commodore 64 .. bulletin boards etc ..
Linux and Unix grounded early in security and then lived on in a bubble of well-being .. methinks the bubble has burst, eh wot !
This has been know in the linux community for a long time and was fixed early last year, so linux users who get constant updates of all open source they use, only lacked protection for a couple of days a year or so ago.
Anyone wonder why suddenly as soon as windows stops supporting xp, this vulnerability suddenly appears, when microsoft, apple, google, have known about it for at least the last year and done nothing.
If someone can make a $
Out of it they will some smart
Buggas out there
I checked the changelogs for previous releases of OpenSSL, but I can't find (or recognise?) any reference to a related fix in releases prior to 1.1.0.
OpenSSL: News, ChangeLog:
https://www.openssl.org/news/changelog.html
http://webcache.googleusercontent.com/search?strip=1&q=cache:https://www.openssl.org/news/changelog.html
OpenSSL Security Advisory [07 Apr 2014]
TLS heartbeat read overrun (CVE-2014-0160)
==========================================
https://www.openssl.org/news/secadv_20140407.txt
http://webcache.googleusercontent.com/search?strip=1&q=cache:https://www.openssl.org/news/secadv_20140407.txt
Note: I have included Google's cached versions of both web pages.
Patches for it have been available for a long time and it was only in the beta release on microsoft, apple and google servers. To the best of my knowledge, dedicated linux servers don't use beta releases as they tend to be buggy and a bit unstable, plus they have extra security measures available to them, but proprietary users don't have the ability to oversee and act on their security as we are seeing with this vulnerability.
When you can take 64k every log in, it's not rocket science to realise it wouldn't be very long before you had all information you need to hack, use DSS, or compromise accounts and services. Vulnerable systems are those which you have no control over the security system, ports or code, so have to rely upon companies to provide them at their pleasure and when profit is the only desired outcome, you get what they give you.
Your link shows this is the case. https://www.openssl.org/news/secadv_20140407.txt
What the Security Advisory page is saying to me is that the following versions were vulnerable to the "TLS heartbeat read overrun" exploit:
1.0.1f
1.0.2-beta1
The same vulnerability was not present in 1.0.1g and 1.0.2-beta2.
However, ISTM that the absence of the vulnerability in current releases may be coincidental rather than the result of a targeted fix, otherwise why would the advisory state the following:
"Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl at chromium dot org> and Bodo Moeller <bmoeller at acm dot org> for preparing the fix."
-- Edited by dorian on Friday 11th of April 2014 10:01:21 AM
Gday...
The back and forth banter and flexing of 'technology muscle' is baffling - rather than helping 'ordinary folk' to know how - or indeed, whether - to respond to this 'virus'.
I retiterate my earlier plea bolded above.
Perhaps the "red haired quote" applies here ... Please Explain.
Cheers - John
-- Edited by rockylizard on Friday 11th of April 2014 10:17:34 AM
There is a huge difference between what proprietary software providers do about their security and what others do. Our major banks fixed this last year, because it was known about back then. Our web site (linux servers) provider, notified us last year they had patched it long ago. The forum I moderate on has linux servers and it was the same with them, fixed it long ago.
You only have to look at the track record of proprietary companies and their approach to security to know they only close vulnerabilities when they become a concern to their customers, who start complaining and gets into the social side of the web. Much of their profit growth is derived from supplying users data to other companies, so they can use it to troll customers on line. Then we have the huge profits they make out of anti virus software, when in reality if the system was a modern decent one, the user would have full control and the ability to block any attack.
This is the 21st century and the only secure systems are open source, windows is wide open as is apple and chrome, they are just a sponges for absorbing peoples data and personal details, which they sell on the open market to any who will pay up. Where do people think all the spam they get comes from, we rarely ever get spam, because we use anonymous proxies and deep web facilities.
Call it scaremongering if you like, as the deniers here certainly will. They've done it in the past, but what I posted earlier about what microsoft will do to force people from earlier versions of windows to last century win8, is happening.
Many others fixed this long ago, only google, apple and microsoft servers have done nothing about it until now when it finally leaked out there was a deliberate vulnerability added, to assist in data mining collection for controlling corporations. That's the situation and always will be as long as profit growth systems are what people lock themselves into, if you read the terms of use, you will soon realise they can take all the data they want from you any time they want and there's nothing you can do about it. No such problems with open course, you own your system and have as much control over it as you want.
"OpenSSL 1.0.1g packages are now available via Anaconda. These packages patch the “heartbleed” vulnerability described in CVE-2014-0160.
Versions Affected
Vulnerable OpenSSL versions are those from 1.0.1 to 1.0.1f inclusive. Version 1.0.1g and forward contain the fix. Other versions of OpenSSL not in the 1.0.1 release branch, such as 1.0.0 or 0.9.8 are not vulnerable."
ISTM that the "heartbleed" vulnerability was present in all official 1.0.1 releases until the release of 1.0.1g a few days ago. Therefore the 1.0.1g heartbleed bugfix was a targeted fix, not an accidental one. I don't know which bugfix you are referring to, but the only times that "heartbeat" is mentioned in the changelogs is the reference to the recently discovered problem and a reference to the introduction of support for "TLS/DTLS heartbeats" on 14 March 2012. The Google Security Team were cited several times for reporting various bugs (19 Apr 2012, v1.0.1a, 1.0.0i, 0.9.8v), but only once in relation to the heartbeat issue.
Now after reading all the posts, I'm even more confused than previously, can someone explain in other than techno babble, if we need to do something and don't come back with the answer you should be using Linux.
Cheers
David
It's data on un-updated servers which are vulnerable, doesn't matter what computer system you are using. There is no advantage in this case with using any system, you can change passwords, but most sites which require good encryption would have overcome the problem already with patches and the majority of linux user servers did that last year. If a windows server uses the vulnerable versions of open ssl, they will have the same problem, on our home server, we use a couple a specialised encryption between the server and our 3 stations which runs on Kali linux which is a dedicated security distro.
Gday...
Some further information on what "we ordinary folk" should perhaps do ...
http://www.startsatsixty.com.au/living/have-you-protected-yourself-against-the-heartbleed-bug
http://www.startsatsixty.com.au/entertainment/technology-entertainment/the-sites-you-need-to-change-your-password-for-now
Not sure if this helps anyone ... Thankfully, personally, I have not had any of my details recorded on any of the sites in the second URL.
Cheers - John
-- Edited by rockylizard on Friday 11th of April 2014 03:32:54 PM
Thanks for the info John, I have passed this onto family and friends, much appreciated
www.staysmartonline.gov.au
frank