Slashdot Mirror
Akamai Reissues All SSL Certificates After Admitting Heartbleed Patch Was Faulty
SpacemanukBEJY.53u (3309653) writes "It took security researcher Willem Pinckaers all of 15 minutes to spot a flaw in code created by Akamai that the company thought shielded most of its users from one of the pernicious aspects of the Heartbleed flaw in OpenSSL. More than a decade ago, Akamai modified parts of OpenSSL it felt were weak related to key storage. Akamai CTO Andy Ellis wrote last week that the modification protected most customers from having their private SSL stolen despite the Heartbleed bug. But on Sunday Ellis wrote Akamai was wrong after Pinckaers found several flaws in the code. Akamai is now reissuing all SSL certificates and keys to its customers."
So Akamai claims that they protected certificates in memory. So that would be independent of the heart bleed bug, if we assume that heartbleed only managed to report "unprotected" data. And someone found that the protection isn't as good as they thought it was. Still doesn't answer the question if the Akamai code was vulnerable to Heartbleed in the first place. (So that's similar to the claims that OpenSSL didn't use malloc and therefore data had less protection, which doesn't make the Heartbleed bug less bad, but could have protected some data).
for having the integrity to admit that they screwed up the first time.
...don't send it over a well-known public network. There are so many potential points of failure on the Internet that I assume anyone sufficiently powerful can see anything I'm doing, from a competitor to a government. The only effective protection is democratic regulation, not an arms race.
Anyway, good on Akamai for admitting to and fixing their fault. Humility is the best trait.
Earlier this morning, I read on another post that someone was saying how Heartbleed compromised many bank's systems. This was contrary to what was posted on sites such as CNET that provided a list of providers and websites that claim they were not vulnerable. It sounded incredulous. Frankly, still does.
I can see financial institutions using an open solution for their public facing websites. But, how many actually "run" an operating system that is based on Open Source for their financial transactions? Exactly. Most, I suspect, are likely running another fully patched, proprietary OS and few, if any, would be permitted to run on public or open software. Still, those customer facing systems could be compromised and there might be a way to capture a customer's banking credentials.
The good news is, if your bank is FDIC insured, your money is safe - up to the limit of the Insurance ($250K???) Still, it's a major inconvenience. And, while there is genuine concern here, there is too much FUD being spread.
What is really needed right now is a secure, public, searchable list of sites that are vulnerable, not vulnerable and unknown. And, institutions what have your contact information or sensitive information (ie. credit card info) should be contacting all customers to inform them if their data or accounts might have been compromised, what actions are being taken, and what actions the customer must take (such as when it's safe to actually change one's password, force a password reset, go to 2 factor authentication, etc).
Lastly, I can understand why a mobile device might not check a certificate revocation list. But, there is no excuse for a desktop server to not check the SSL cert's validity. And, if the user still wants to go to the site, the warning should remain on the screen a highly visible form (like putting a BIG red border about the frame with text reading (THIS SITE MAY HAVE BEEN COMPROMISED) .
More than a decade ago, Akamai modified parts of OpenSSL it felt were weak related to key storage
Now that's insight!
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
This event demonstrates the problem with giving your company a boastful name.
Perhaps they should have named the company kapakahi instead.
a) I would not say this is the worst ever - it allows random data to be viewed, which may or may not contain something valuable. There is no evidence (yet) that this was actually exploited prior to its publication. Various other breeches have resulted in proven loss of millions of identities, and near-billions in actual money. If it had been exploited very much, it would probably have been tracked down earlier.
Technically it's not the worst - it's the same as literally thousands of other exploited bugs, and just yet another example of why C should not be used for applications programming, at least without a very strong IDE to catch these kinds of problems and perhaps a macro system that forces bounds-checking, etc. 'Programming without a net' is _sometimes_ necessary for programming at the metal interface, but OpenSSL, though needing high performance, is not an example of that. It's also an example of why SW quality methods need to be followed for this kind of code, especially for a relatively new member of the programming team - and why OpenSSL and other OSS projects need our support.
b) Fortunately, the barn door seems to have been shut before much got out. We'll see, but that's the present apparent situation. There will probably be a few relatively small ongoing successful exploits on servers that don't get fixed, as usual. But this is not anything like a wholesale loss of 100 million credit card records.
c) In this case there was a failure of the open source model of 'many eyes'. But there have been thousands of such failures in proprietary software, some of which resulted in most of the really big exploits, that were invisible until the exploit was used. Here, open source at least allowed researchers to identify it before it was really exploited (as far as we know today).
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
Nope, the cyclons have solid configuration management on the Centurions and the meatbops don't have open ports.
No, I remember a Sendmail hole that was worse...but that was open source too!
Oh no, "say it ain't so" Hahahaha (unbelievable)