Menu
Tests confirm Heartbleed bug can expose server's private key

Tests confirm Heartbleed bug can expose server's private key

CloudFlare said its challenge shows how dangerous is the OpenSSL bug

Four researchers working separately have demonstrated a server's private encryption key can be obtained using the Heartbleed bug, an attack thought possible but unconfirmed.

The findings come shortly after a challenge created by CloudFlare, a San Francisco-based company that runs a security and redundancy service for website operators.

CloudFlare asked the security community if the flaw in the OpenSSL cryptographic library, made public last week, could be used to obtain the private key used to create an encrypted channel between users and websites, known as SSL/TLS (Secure Sockets Layer/Transport Security Layer).

The private key is part of a security certificate that verifies a client computer isn't connecting with a fake website purporting to be a legitimate one. Browsers indicate a secure connection with a padlock and show a warning if the certificate is invalid.

Security experts thought it might be possible that the private key could be divulged by exploiting the Heartbleed flaw, which may have affected two-thirds of the Internet and set off a mad scramble to apply a patch that fixes it.

"This result reminds us not to underestimate the power of the crowd and emphasizes the danger posed by this vulnerability," wrote Nick Sullivan of CloudFlare on the company's blog.

By obtaining the private key for an SSL/TLS certificate, an attacker could set up a fake website that passes the security verification. They could also decrypt traffic passing between a client and a server, known as a man-in-the-middle attack, or possibly unscramble encrypted communications they've collected in the past.

CloudFlare set up a server running the nginx-1.5.13 web server software using OpenSSL version 1.0.1.f on Ubuntu 13.10 x86_64.

Fedor Indutny of Moscow was the first person to obtain the key, Sullivan wrote. The Heartbleed bug divulges data in 64K batches from a computer's memory. The data can include login credentials for people who have recently logged into the server.

Attackers can keep hitting the server repeatedly, each time obtaining 64K of data in memory. The Heartbleed attack is particularly dangerous since it leaves few traces, allowing attackers to continue to try until they obtain the desired information.

Researchers are still trying to figure out the conditions under which what specific data is revealed. OpenSSL, an open source program, is used in a wide variety of operating systems, mobile applications, routers and other networking equipment.

Sullivan wrote Indutny sent 2.5 million requests to the test server over the course of a day. The second person to get the key, Ilkka Mattila of the National Cyber Security Centre Finland, obtained it with fewer requests, around 100,000, he wrote.

In an update to the blog post, Sullivan wrote two others also completed the challenge: Rubin Xu, a doctoral student at Cambridge University, and Ben Murphy, a security researcher.

"We confirmed that all individuals used only the Heartbleed exploit to obtain the private key," Sullivan wrote.

How the researchers each accomplished obtaining the private key hasn't been revealed. "It is at the discretion of the researchers to share the specifics of the techniques used," Sullivan wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Exploits / vulnerabilitiesCloudFlare

Brand Post

What to expect from your IT Distributor

Whether you’re just starting out or you’ve been around since before the dot com rollercoaster, choosing the right distribution partner can be a pivotal factor in your success. This definitive guide outlines the traits that every IT partner needs to look for in their IT Distributor.

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments