Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Heartbleed: Examining The Impact
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
4/13/2014 | 9:12:33 AM
Secure Computing in a Compromised World
the impact is less than you might think:   we all live in a heavilly compromised world due to years of poor practice.

 

i posted some notes on this here:

 

https://www.schneier.com/blog/archives/2014/04/friday_squid_bl_419.html#c5430516
tsapio
50%
50%
tsapio,
User Rank: Author
4/12/2014 | 8:35:59 AM
Re: Assessing damage
For maximum security assurance, you should patch all your servers, change all passwords, revoke and reissue all certificates, and consider the impact of everything served by vulnerable systems being compromised. Each company will have to make their own decisions in this regard. As I stated above, there is no way of telling what (if anything) has actually been compromised. It is one of the worst features of this attack, and there is no way to find out retroactively. If it passed through a vulnerable web server, it is potentially compromised.
tsapio
50%
50%
tsapio,
User Rank: Author
4/12/2014 | 8:32:38 AM
Re: Assessing damage
It is theoretically possible to determine by examining server logs that a possible attack has occurred. However, what has been compromised is still going to be almost impossible to determine since what is being compromised is contents of memory adjacent to the buffer that holds the normal heartbeat response. This information is not going to be logged under normal circumstances. It would be extremely memory intensive to do so, and very time consuming to analyze. My recommendation is to close off this hole because it is the easiest and safest course of action.
Thomas Claburn
100%
0%
Thomas Claburn,
User Rank: Ninja
4/10/2014 | 6:59:53 PM
Re: Assessing damage
Is there any consensus on the need to change passwords? I keep reading differing opinions.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
4/10/2014 | 4:27:47 PM
Assessing damage
Thanks for a fascinating article Tim.  Now that the bug has been identified, going forward I assume it will be easier to tell when a breach has occurred. Or not? 

 


News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31414
PUBLISHED: 2021-04-16
The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.
CVE-2021-26073
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or ...
CVE-2021-26074
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a se...
CVE-2018-19942
PUBLISHED: 2021-04-16
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QT...
CVE-2021-27691
PUBLISHED: 2021-04-16
Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request...