Slashdot Mirror

← Back to Stories (view on slashdot.org)

Heartbleed Disclosure Timeline Revealed

Posted by samzenpus on from the when-did-you-know dept.

bennyboy64 (1437419) writes "Ever since the Heartbleed flaw in OpenSSL was made public there have been various questions about who knew what and when. The Sydney Morning Herald has done some analysis of public mailing lists and talked to those involved with disclosing the bug to get the bottom of it. The newspaper finds that Google discovered Heartbleed on or before March 21 and notified OpenSSL on April 1. Other key dates include Finnish security testing firm Codenomicon discovering the flaw independently of Google at 23:30 PDT, April 3. SuSE, Debian, FreeBSD and AltLinux all got a heads up from Red Hat about the flaw in the early hours of April 7 — a few hours before it was made public. Ubuntu, Gentoo and Chromium attempted to get a heads up by responding to an email with few details about it but didn't, as the guy at Red Hat sending the disclosure messages out in India went to bed. By the time he woke up, Codenomicon had reported the bug to OpenSSL."

6 of 62 comments (clear)

  1. "Independent" discovery? by Red+Herring · · Score: 5, Interesting

    > Google discovered Heartbleed on or before March 21 and notified OpenSSL on April 1. Other key dates include Finnish security testing firm Codenomicon discovering the flaw independently of Google at 23:30 PDT, April 2.

    Doesn't it seem strange that the flaw has existed for a long, long time (years?) but Codenomicon happens to find it less than a day after Google notified OpenSSL, and, per the article, "some infrastructure providers under embargo"? That just seems... unlikely. Not impossible, but it kind of makes you wonder who is leaking information...

    --
    #include "standard_disclaimer.h"
    1. Re:"Independent" discovery? by Albanach · · Score: 5, Interesting

      Not necessarily. It may be that the bug was known to others and that Google and Codenomicon were both monitoring channels used by more nefarious types. Both organizations may have independently 'discovered' the bug after each becoming aware that an exploit existed without having full details of the exploit.

    2. Re:"Independent" discovery? by AdhSeidh · · Score: 5, Interesting

      perhaps you have already forgotten about CVE-2014-1266 the Apple SSL/TLS bug from Februrary this is why every security group on the planet was looking for other encryption related loopholes

    3. Re:"Independent" discovery? by rmdingler · · Score: 4, Interesting
      In all likelihood, there was a "discovery" by Google that led to a sharing of information with Codenomicon... someone told an old college buddy or former co-worker.

      There were almost certainly folks who were aware of the vulnerability before Google.

      Were these folks criminals or government employees? And yes, there's a small difference... generally found in the probability for prosecution.

      --
      Happiness in intelligent people is the rarest thing I know.

      Ernest Hemingway

  2. Negligence by Daniel+Ellard · · Score: 3, Interesting

    Why did Google wait ten days before notifying OpenSSL? (even if they didn't trust OpenSSL to handle it responsibly, it couldn't have taken ten days for Google to patch their systems)

    --
    Disclaimer: I work for a company, but I don't speak for them.
  3. Damn sleep... by Anonymous Coward · · Score: 3, Interesting

    Ubuntu, Gentoo and Chromium attempted to get a heads up by responding to an email with few details about it but didn't, as the guy at Red Hat sending the disclosure messages out in India went to bed.

    I don't know why, but this reminded me of Cyril Evans. Never go to bed.