Everyone panic: Critical OpenSSL vulnerability: the "heartbleed" bug

[vezzy]

We can't really tell. The bug was a missing bounds check, so it could very easily be written off as incompetence. Memory-unsafe languages like C are notoriously hard to get completely right, anyway.

And yeah, all distros are pushing package upgrades. Security bugs always warrant it, anyway.

[kenjoe41]

Dude that was massive, i guess i better change my 6 char* password to something longer. Good thing i didn't waste your time at cracking it with some other serious technique.

Seriously, it would be wise if you guys change your passwords cos this has exposed alot of us.

[Satan911]

Technical writeup: http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html

[iTpHo3NiX]

Dude that was massive, i guess i better change my 6 char* password to something longer. Good thing i didn't waste your time at cracking it with some other serious technique.

Seriously, it would be wise if you guys change your passwords cos this has exposed alot of us.

Well some of us use different passwords and usernames on a barrage of different sites

[lucid]

For those of you Arch users they've pushed out the fixed openssl.

[Axon]

Metasploit Module for HeartBleed bug
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb

[proxx]

Metasploit Module for HeartBleed bug
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb

I was waiting for that
Couldnt find it this morning, those guys are fast.
<3 seashells.

[Pillus]

Aaaand here is the nmap NSE script, which makes it even easier
http://seclists.org/nmap-dev/2014/q2/att-27/ssl-heartbleed.nse

[voodoo]

For those of you Arch users they've pushed out the fixed openssl.

Noticed and updated immediately.

[neusbeer]

oef..pretty nasty bug indeed..
took 5 sec. to get a sessionid from a site and to log in.

[proxx]

[ande]

@proxx, saw it on fb, loved it x)

I would like to point out that, unless you have javascript disabled, your Evilzone passwords are sent hashed from your browser to our servers. That only makes them secret tho, not unusable. But ofc sessions could have been stolen, tho they are less permanent.

[iTpHo3NiX]

OpenSSL Heartbleed bug http://9gag.com/gag/a756d3z

Posted on le gag that is 9

[Stackprotector]

I fucking hate the internet and everything if this is true: http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html

[0poitr]

aaand something interesting here as well
http://blog.cloudflare.com/answering-the-critical-question-can-you-get-private-ssl-keys-using-heartbleed

They put up a open challenge to exploit and get the private keys off a vulnerable server.