Menu
Reverse Heartbleed puts your PC and devices at risk of OpenSSL attack

Reverse Heartbleed puts your PC and devices at risk of OpenSSL attack

A password management service discovers that the Heartbleed bug can be used to target individual users.

The Internet has been abuzz for the last week or so in response to the Heartbleed vulnerability in OpenSSL. While almost all of the attention has centered on patching Web servers and advising users to change their passwords, security researchers have discovered that individual client PCs and devices are also at risk thanks to "Reverse Heartbleed."

Meldium, a Cloud identity and access management service, shared details of the Reverse Heartbleed threat in a blog post. An attacker can exploit Heartbleed to expose sensitive data on vulnerable servers, but that's not the only attack possible using this flaw. The "heartbeat" used in the Heartbleed attack can be initiated by either the client or the server, so a malicious server can also send bad heartbeat packets to an OpenSSL client to extract data.

"It's the popularity and pervasiveness of the OpenSSL library that makes this vulnerability difficult to remediate fully," said Tim Erlin, director of IT security and risk strategy for Tripwire. "While popular Web applications may be already patched, the myriad of appliances, embedded devices, and network infrastructure that may be vulnerable will take a lot longer to address. You can't just disable the Internet for maintenance."

OpenSSL is a widely-used implementation of SSL, used in a diverse array of devices to secure Internet communications. Websites and online services are working diligently to patch and update in response to the Heartbleed threat, but browsers, applications, and connected devices that rely on OpenSSL are also potentially vulnerable to Heartbleed and/or Reverse Heartbleed. For example, both Cisco and Juniper have acknowledged that many of their home routers and networking devices are vulnerable.

According to Meldium, the server-initiated Reverse Heartbleed attack is slightly more difficult to successfully exploit for a few reasons. For instance, it can only be attempted once the TLS connection has been established. There are security controls used by some clients that will detect that the server certificate doesn't match and abort the connection.

Meldium advises the same mitigation and remediation for Reverse Heartbleed as for Heartbleed, but stresses, "The important takeaway is that it's not enough to patch your perimeter hosts--you need to purge bad OpenSSL versions from your entire infrastructure."

The same holds true for individual home users. You should check with the developer or vendor for any software or devices that connect to the Internet to determine if they rely on OpenSSL and whether or not there is a patch available. Refrain from using any affected applications or devices, and apply any updates as soon as possible.

Meldium has created a Reverse Heartbleed Tester you can use to determine if you're vulnerable.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securitynetwork securityTripwireInternet of ThingsHeartbleedMeldium

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments