Slashdot Mirror
Heartbleed Used To Bypass 2-Factor Authentication, Hijack User Sessions
wiredmikey (1824622) writes "Security nightmares sparked by the Heartbleed OpenSSL vulnerability continue. According to Mandiant, now a unit of FireEye, an attacker was able to leverage the Heartbleed vulnerability against the VPN appliance of a customer and hijack multiple active user sessions. The attack bypassed both the organization's multifactor authentication and the VPN client software used to validate that systems connecting to the VPN were owned by the organization and running specific security software.
"Specifically, the attacker repeatedly sent malformed heartbeat requests to the HTTPS web server running on the VPN device, which was compiled with a vulnerable version of OpenSSL, to obtain active session tokens for currently authenticated users," Mandiant's Christopher Glyer explained. "With an active session token, the attacker successfully hijacked multiple active user sessions and convinced the VPN concentrator that he/she was legitimately authenticated."
After connecting to the VPN, the attacker attempted to move laterally and escalate his/her privileges within the victim organization, Mandiant said."
"Specifically, the attacker repeatedly sent malformed heartbeat requests to the HTTPS web server running on the VPN device, which was compiled with a vulnerable version of OpenSSL, to obtain active session tokens for currently authenticated users," Mandiant's Christopher Glyer explained. "With an active session token, the attacker successfully hijacked multiple active user sessions and convinced the VPN concentrator that he/she was legitimately authenticated."
After connecting to the VPN, the attacker attempted to move laterally and escalate his/her privileges within the victim organization, Mandiant said."
that one of their favorite exploits got outed. Was this an intentional vulnerability, like RSA?
Intentionally vulnerable - so this wasn't a bug in the NGINX server, it was a feature, right?
Was this before the public disclosure, or after?
News: Not just webservers use OpenSSL!
No kidding. My Synology NAS had a same-day update to patch this - my custom router firmware needed updating too. If there's a story for every device someone forgot might contain OpenSSL code, it's going to be a busy month.
It seems completely obvious to me that each authenticated session to any remote server should be running as a separate user. There is something so fundamentally wrong about any security model where it is possible for the code executing for one user to access data private to another user.
This is why a competent VPN will run ipsec and not some silly little ssl - tls implementation that allows a session token that can be copied.
So they were merely confirming how bad bad could get by proving that technology that relies on OpenSSL is vulnerable. Okay, thanks. I suppose there are a lot of people who might try denying that - I've already heard people muttering that the firms which are vulnerable to this exploit should have a workaround in place. This demonstration could well serve as an example of just how difficult that could be, as well as how wide-reaching the problem is.
I'm not convinced this wasn't an intentional effort to backdoor OpenSSL.
Code was submitted on new year's eve. A moment when the fewest people would be available to review it. Many people are on vacation and likely to gloss over the pile of code submitted while they were gone.
Just because he's a professor doesn't mean he wasn't compromised. A common page out of spycraft textbook would be to get an agent to seduce the professor and then document his infidelity. With this hanging over his head, he'll plant the requested vulnerability and even after it's discovered, he'll stick to the cover story to prevent those photos from being sent to his wife. For further reading on this topic, see the wikipedia page on Julian Assange.
$5 / month hosted VPS on linux = awesome!
Lots of people scoffed at Bruce Schneier for saying Heartbleed is an 11 on the 1-10 scale... I agree that sometimes he goes overboard but this is not one of those times, and the attack mentioned in the article demonstrates this.
The summary is a little muddled on what happened here, but if you follow the link you'll find this is not a security test or a research group showing something could theoretically be done. This is a real live company somewhere just using a VPN many other companies probably use, that had over the course of many hours multiple VPN session hijacked and made use of. That is a huge deal, if one person can do this you can almost bet there is a script somewhere that even the great unwashed hacker masses can make use of.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Session token as an authenticator isn't multifactor. If I can resume your VPN session from a different IP than you established the link then it sounds like time to rethink how you are doing session management.
I already am on Windows you insensitive clod!
Searching... About 1,250,000 results.
The best option would obviously be a beowulf cluster of Natalie Portmans eating some hot grits, you insensitive clod! I only use trackpads, you insensitive clod! I'm self-employed, you insensitive clod! It is summer here, you insensitive clod! I don't have a car, you insensitive clod! I'm Amish, you insensitive clod! I'm self-unemployed, you insensitive clod! I have no SuperDrive, you insensitive clod! I live on zero dimensions, you insensitive clod! I'm a nudist, you insensitive clod! It's Heineken, you insensitive clod! I don't use local storage, you insensitive clod! :I am on my Windows machine you insensitive clod! I'm English you insensitive clod! I don't need more job competition, you insensitive clod! I am a phd candidate working in an university lab, you insensitive clod! I live in Australia, you insensitive clod! People are continuous, you insensitive clod! A pre-emptive 'you insensitive clod' comment. :I use Dvorak, you insensitive clod! one way to look at a thing, and it's "MY" way you insensitive clod! Bots need to catch up on their favorite shows too, you insensitive clod! I' m a third grader, you insensitive clod! I have never said 'you insensitive clod!' in a post that I remember... I'm in marketing, you insensitive clod! Brine is delicious, you insensitive clod! hey, I still work as a government contractor, you insensitive clod! I don't watch TV you, insensitive clod! Neither I have a TV, you insensitive clod! Neither I use english grammar you, insensitive clod! Engrish is not my language, you, insensitive, clod! That's Japan you insensitive CLOD! I don't think the Mongolians would appreciate you calling them 'aliens', you insensitive clod! I USE IE, YOU INSENSITIVE CLOD!! listens to Zulu chants on a purple Zune all day long and snorts without a whistle when I 'laugh', you insensitive clod! I'm still on 28.8kbps dial-up you insensitive clod! bla bla bla 300bps you insensitive clod! I can't afford to go on vacation, you insensitive clod! In Soviet Sicily, the story confirms YOU, you insensitive CLOD! I can do that without cocaine, you insensitive clod! Hey, I love feta you insensitive clod! I'm from Poland, you insensitive clod! Senior citizens can date too you insensitive clod! I dont eat corn you insensitive clod! I don't have a "you insensitive clod!" button, you insensitive clod! I'm a bald physicist, you insensitive clod! I eat two donuts at a time, you insensitive clod! I am cloud-intensive, you insensitive clod! I'm a homophobic straight male, you insensitive clod! :I use a Mac you insensitive clod! No car, you insensitive clod! Some users will also refer to seemingly innocent remarks by correcting them and adding "you insensitive clod!" to the statement... But I take my shit in the mornings, you insensitive clod!
many eyes, my ass.
Just as a side note, for any corporate intranet with VPN and web servers facing the outside world, it really is a good idea to isolate your various services, so if one is compromised, the others aren't. This is a classic example of why you should do that: If the web server and VPN were on separate VM's, heartbleed fishing through the web server wouldn't have exposed the VPNs keys.
I wish I could afford to practice that myself, I unfortunately lump all my internet facing services on one VM, but for a corporation with more assets, it really is a cheap way to cover your butt.
Please be specific. Try to express yourself with more than a thinly veiled one-line ad hominem statement. Written exposition demonstrating linguistic and reasoning skills appropriate to an adult would also be desirable.
Your application server shouldn't be running SSL.
I can't think of one good reason to expose your application server to the internet.
Has the bug been fixed or not? Or is this a case of poor security management by not applying the fix??
Jack of all trades,master of none
OpenBSD supplied 250 commits in a week.
Who else thinks the NSA doesn't find shit like this on a daily basis?