OpenSSL "Heartbleed" vulnerability

Mac_Fife · **Posted:** Tue Apr 08, 2014 7:05 pm

Since I'd posted a download link previously for the openssl32 and libeay32 DLLs in this post: viewtopic.php?p=400713#p400713, and in light of the recently announced vulnerability in recent versions of OpenSSL (http://www.openssl.org/news/secadv_20140407.txt) I thought I ought to rebuild the DLLs from the new, fixed sources, for anyone that doesn't want to try building them themselves.

I've removed the old download link since those files may be unsecure and the new one is here: http://uru.mac-fife.me.uk/openssl-1.0.1g.zip

Charura · **Joined:** Wed Oct 14, 2009 4:14 pm **Posts:** 1773

Who does this effect? Everyone playing URU Live? I'm confused, as usual... :oops:

Annabelle · **Posted:** Wed Apr 09, 2014 12:43 am

I would say it's a post aimed toward developers & coders more than the alpha explorers like us Charura.

Here's my rule of thumb: If you don't understand what a post is all about then it's not aimed toward you :lol:

("you" here is a general "you", it includes myself as well)

It might affect us in some way, logically, since we are using these DLL in our clients, at least the Skydiving Client, but I have no idea what should be done so I'll wait for posts from more savvy folks

AdamJohnso · **Posted:** Wed Apr 09, 2014 12:45 am

Uru is not vulnerable.

Mac_Fife · **Posted:** Wed Apr 09, 2014 5:35 pm

What Adam says.

I'd previously posted a set of these files as there was a little concern about the integrity of some of the versions available on DLL download sites - I built these DLLs myself from the original sources, so I could vouch for their authenticity. That was originally to help some people that were installing the Skydiver client and didn't have the DLLs to hand for one reason or another. However, in the context of the discussion about the download sites, I couldn't be sure if some people were maybe using my DLL set for other purposes (although I excluded the OpenSSL.exe file from the zip), so rather than risk continuing to propagate a potentially vulnerable file set, I pulled the original download and replaced it with an up-to-date set.

Jamie Marchant · **Posted:** Thu Apr 10, 2014 6:26 pm

Here is a site where you can test weather or not a site has the bug:
http://filippo.io/Heartbleed/?_ga=1.207 ... 1384201823

It appears that most of the sites I use are currently unaffected. These include: Facebook, Google and Paypale. From what I've read anything that uses Microsoft's ISS is also safe, so Hotmail and Skype should also be safe.

Now keep in mind not to change any passwords until the site admin tells you 'its safe' and the bug has been fixed. If this does not happen you where probably safe all along.

belford · **Joined:** Thu Jun 08, 2006 7:01 pm **Posts:** 1890

Google *was* affected but got patches out very quickly. I haven't seen them say to change your password, but I did it anyway.

Some parts of Amazon were affected. (Now patched.) Facebook says they solved the problem before it was reported but I don't believe them.

Mac_Fife · **Posted:** Thu Apr 10, 2014 7:16 pm

Windows servers running IIS don't use OpenSSL for encryption so won't be affected by this precise vulnerability (they might have other, similar ones, but not this one). Even among Linux/Apache servers not all will be affected since it's only those using OpenSSL 1.0.1 up to and including 1.0.1f. I checked some hosting services that I know of and found that they actually used an older version, e.g. 0.9.8e, that isn't affected - it rather depends on when they built their Apache server and if it was before March 2012, when OpenSSL 1.0.1 was released, then it'll be OK (and that could be Facebook's "fix"

).

Server admins will probably tell you a) if they were affected and you ought to change passwords and b) when to change it - as Jamie says there's little point in changing passwords until the server is fixed.

Further, it's only websites that use SSL/TLS (where the address begins with https: instead of just http:) that are involved, so most forums, etc., don't come into it: Your login is not encrypted anyway so there are no server keys to steal. The exception arises if you use the same login details as on a "secure" site that you know was affected, because then your credentials might have been captured from the "secure" site and could be used elsewhere. In that case you can go ahead and change passwords on the unsecure sites anytime you like.

Frankly, I think the problem is maybe a little over-hyped by the media, and the number of servers at risk isn't as great as they'd have us believe. There's no particular evidence I've seen to suggest that the exploit has actually been used (e.g. big lists of login details or server keys or faked security certificates for sale). In fact the media attention of the last couple of days has probably done more to elevate the risk, while admins try to get servers updated.

Jamie Marchant · **Posted:** Thu Apr 10, 2014 8:06 pm

I agree with your last point Mac, the media seem to be overplaying things. Now on the topic of passwords it should be noted that any unencrypted data can be 'relativity' easily captured. For this reason I never use my 'secure site' password on unsecure sites. Also I have no clue why Google hasn't told us to change our passwords but I imagine they would if they felt it was nessisery.(maybe they want to make sure the problem is indeed solved before having everyone change them).

belford · **Joined:** Thu Jun 08, 2006 7:01 pm **Posts:** 1890

Quote:

I agree with your last point Mac, the media seem to be overplaying things.

Schneier says it's bad, and I trust him on this stuff.

I agree that this isn't a big deal for web forums. But if you buy stuff online, or bank online, or sign up for health insurance online, or use a Gmail address as the "forgot my password" email on any site -- then you're relying on somebody's HTTPS security. All of that is now potentially compromised until each site cleans itself up. I expect Google to be fast at that, but my bank? Who the heck knows.

EDIT-ADD: http://mashable.com/2014/04/09/heartble ... -affected/

Mac_Fife · **Posted:** Fri Apr 11, 2014 7:55 pm

And for anyone interested in the geeky details of the bug, CloudFlare have posted a blog that makes quite good reading without being overly technical - http://blog.cloudflare.com/answering-th ... heartbleed - it also includes a challenge to try to extract private keys from a server they've deliberately left vulnerable.

Nalates · **Posted:** Sat Apr 12, 2014 3:32 pm

If you use a site using SSL, you can check to see if they have made the repair: https://www.ssllabs.com/ssltest/

I suspect they are just checking version numbers, but that should be good enough.

hhhenry · **Posted:** Sat Apr 12, 2014 11:37 pm

Intuit/TurboTax was affected. THATS a Big Deal. My bank said they fixed it last week nothing to worry about weasel word weasel word move along folks. Yeah, time to change passwords and pin there too.

Mac_Fife · **Posted:** Fri Jun 06, 2014 10:07 pm

Some lesser vulnerabilities were found during the process of fixing the "Heartbleed" bug (https://www.openssl.org/news/secadv_20140605.txt), so there's been a further up-issue of OpenSSL.

I've rebuilt the DLLs again from the 1.0.1h sources and posted them here: http://uru.mac-fife.me.uk/openssl-1.0.1h.zip

As previously noted, Uru isn't really affected much by these issues, but if you're downloading the DLLs at all (e.g. for the skydiver client) then it makes sense to use the latest ones.

OpenSSL "Heartbleed" vulnerability

Who is online