Menu
Tests confirm Heartbleed bug can expose server's private key

Tests confirm Heartbleed bug can expose server's private key

CloudFlare said its challenge shows how dangerous is the OpenSSL bug

Four researchers working separately have demonstrated a server's private encryption key can be obtained using the Heartbleed bug, an attack thought possible but unconfirmed.

The findings come shortly after a challenge created by CloudFlare, a San Francisco-based company that runs a security and redundancy service for website operators.

CloudFlare asked the security community if the flaw in the OpenSSL cryptographic library, made public last week, could be used to obtain the private key used to create an encrypted channel between users and websites, known as SSL/TLS (Secure Sockets Layer/Transport Security Layer).

The private key is part of a security certificate that verifies a client computer isn't connecting with a fake website purporting to be a legitimate one. Browsers indicate a secure connection with a padlock and show a warning if the certificate is invalid.

Security experts thought it might be possible that the private key could be divulged by exploiting the Heartbleed flaw, which may have affected two-thirds of the Internet and set off a mad scramble to apply a patch that fixes it.

"This result reminds us not to underestimate the power of the crowd and emphasizes the danger posed by this vulnerability," wrote Nick Sullivan of CloudFlare on the company's blog.

By obtaining the private key for an SSL/TLS certificate, an attacker could set up a fake website that passes the security verification. They could also decrypt traffic passing between a client and a server, known as a man-in-the-middle attack, or possibly unscramble encrypted communications they've collected in the past.

CloudFlare set up a server running the nginx-1.5.13 web server software using OpenSSL version 1.0.1.f on Ubuntu 13.10 x86_64.

Fedor Indutny of Moscow was the first person to obtain the key, Sullivan wrote. The Heartbleed bug divulges data in 64K batches from a computer's memory. The data can include login credentials for people who have recently logged into the server.

Attackers can keep hitting the server repeatedly, each time obtaining 64K of data in memory. The Heartbleed attack is particularly dangerous since it leaves few traces, allowing attackers to continue to try until they obtain the desired information.

Researchers are still trying to figure out the conditions under which what specific data is revealed. OpenSSL, an open source program, is used in a wide variety of operating systems, mobile applications, routers and other networking equipment.

Sullivan wrote Indutny sent 2.5 million requests to the test server over the course of a day. The second person to get the key, Ilkka Mattila of the National Cyber Security Centre Finland, obtained it with fewer requests, around 100,000, he wrote.

In an update to the blog post, Sullivan wrote two others also completed the challenge: Rubin Xu, a doctoral student at Cambridge University, and Ben Murphy, a security researcher.

"We confirmed that all individuals used only the Heartbleed exploit to obtain the private key," Sullivan wrote.

How the researchers each accomplished obtaining the private key hasn't been revealed. "It is at the discretion of the researchers to share the specifics of the techniques used," Sullivan wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securitydata breachCloudFlareencryptionExploits / vulnerabilitiesdata protection

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments