Quote:

---

Heartbleed is a bug in OpenSSL’s implementation of a small part of the T.L.S. protocol, called the heartbeat extension. A “heartbeat,” in this context, is like the “beep… beep…” of a hospital heart monitor: a quick way to check that the other end of a secure connection is still there. One side sends the other side a small piece of data, up to sixty-five kilobytes long, along with a number indicating the size of the data that has been sent. The other side is supposed to send back the exact same piece of data to confirm that the connection is still active. Unfortunately, in OpenSSL the replying side looks at the stated size of the data rather than at the actual size, and it always sends back the amount of data that the request asked for, no matter how much was sent. This means that if the stated amount of data is more than the amount actually provided, the response contains the data that was sent plus however much additional data, drawn from the contents of the computer’s system memory, is required to match the amount requested.

Here is why this is so bad: the heartbeat response can contain up to sixty-four kilobytes of whatever data happens to be in the server’s random access memory at the moment the request arrives. There is no way to predict what that memory will contain, but system memory routinely contains login names, passwords, secure certificates, and access tokens of all kinds. System memory is temporary: it is erased when a computer is shut down, and the data it holds is written and overwritten all the time. It is generally regarded as safe to load things like cryptographic keys or unencrypted passwords into system memory—indeed, there is little a computer can usefully do without temporarily storing pieces of sensitive data in its system memory. The Heartbleed bug allows an attacker to “bleed” out random drops of this memory simply by asking for it. Heartbeat requests aren’t usually logged or monitored in any way, so an attack leaves no trace. It’s not even possible to distinguish malicious heartbeat requests from authentic requests without close analysis. So an attacker can request new pieces of system memory over and over again; it’s almost impossible for the victim to know they’ve been targeted, let alone to know what data might have been stolen.

---

Quote:

---

Here is a situation that is really disturbing. A major security issue that concerns everyone and exposes everyone to financial and social jeopardy is known to the security agencies of the government as early as November 2013.
Do they inform the banks and others that hold millions of peoples personal and financial information?
Do they send a warning for people to take defensive measures?
Do they try and fix the problem as quickly as possible?
If you answered no to all of the above you would be correct.

Instead they make use of the exploit themselves and leave everyone out there to be exploited by others from around the world.

Are not these agencies there to defend us from those who would do us harm?

I guess not. They are too busy watching personal communications to worry about such simple problems as national security or your personal safety. At what point will the public realize that they are not considered in the least bit important to these agencies and stop constantly quipping that they are not worried since they have nothing to hide. Well for one example maybe your bank accounts and related passwords might not be something you wish to share with the rest of the world. Do you really think that it was only the NSA that was using this exploit?

---

Quote:

---

Originally posted by SIGNYM:
since they TOO are using Microsoft [which - the joke goes- describes Bill Gates' penis as well as software security.]

---

Quote:

---

Originally posted by chrisisall:
I guess I should empty my bank account so no one steals my $75 right now, eh?

---

Quote:

---

Originally posted by SIGNYM:
NSA SAYS "FUCK YOU!" LOUD AND CLEAR TO ALL OF USA
http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbl
eed-bug-exposing-consumers.html

---