Slashdot Mirror

← Back to Stories (view on slashdot.org)

New OpenSSL Man-in-the-Middle Flaw Affects All Clients

Posted by timothy on from the disclosure-of-diclosure dept.

Trailrunner7 (1100399) writes 'There is a new, remotely exploitable vulnerability in OpenSSL that could enable an attacker to intercept and decrypt traffic between vulnerable clients and servers. The flaw affects all versions of the OpenSSL client and versions 1.0.1 and 1.0.2-beta1 of the server software. The new vulnerability could only be exploited to decrypt traffic between a vulnerable client and a vulnerable server, and the attacker would need to have a man-in-the-middle position on a network in order to do so. That's not an insignificant set of conditions that must be present for a successful attack, but in the current environment, where open wireless networks are everywhere and many users connect to them without a second thought, gaining a MITM position is not an insurmountable hurdle. Researchers who have looked at the vulnerable piece of code say that it appears to have existed, nearly unchanged, in the OpenSSL source since 1998.'

17 of 217 comments (clear)

  1. Neat by Anrego · · Score: 4, Insightful

    But if you have a man in the middle position, most of those same users would have just clicked "ignore" or typed yes to the "connect anyway" prompt.

    1. Re:Neat by bluefoxlucid · · Score: 3, Insightful

      Speed limits are overly conservative, and it is entirely possible to drive fast and drive safely. Risk increases, but driver ability modifies the risk. Good brakes are even more important in such situations.

      I don't pay much attention to speed limits. The signs are posted miles apart and easy to miss; I drive with the flow of traffic, slowing down when there is additional risk. Additional risk includes traffic calming zones (whether zoned properly or not), e.g., residential areas with street parking and children, where risk is incredibly high--the proper way to drive these is slow, with your foot off the accelerator, prepared to brake. Other risks include commercial areas with lots of pedestrian traffic and street parking in general, where driving at-speed is fine; in these situations, you must search for hazards and prepare to steer or brake as needed to avoid them.

      Driving analogies always show how terrible we are at driving. People care so much about the folks driving 40mph in a 30mph zone, but they don't care about the people cruising mindlessly while staring straight ahead and taking no notice of kids playing by the street, people preparing to exit parked cars, or other cars about to turn in front of them without looking for cross traffic. These are people who will be utterly surprised and incapable of reacting when someone's kid pops out from behind a car, or when a driver exits his vehicle 10 feet in front of them.

      --
      Support my political activism on Patreon.
    2. Re:Neat by duke_cheetah2003 · · Score: 3, Insightful

      Society is asking you to follow the law, not to interpret or judge its validity.

      Sorry, wrong. Society is asking you drive safely and responsibly. Following the law helps, but not every time, not every circumstance.

  2. Re:Key phrase of vulnerability : by ColdWetDog · · Score: 5, Insightful

    "but in the current environment, where open wireless networks are everywhere and many users connect to them without a second thought"

    As will always be. Any attempt at security by involving the end user is a recipe for failure.

    We're doomed.

    --
    Faster! Faster! Faster would be better!
  3. Versions by Anonymous Coward · · Score: 3, Insightful

    Just to be clear, versions 1.01 and 1.02(beta) is the same as saying "Any OpenSSL version released since early 2012", right? It sounds like the summary is trying to downplay the threat a little bit.

    1. Re:Versions by Zero__Kelvin · · Score: 4, Insightful

      "especially after everyone panic-upgraded after heartbleed."

      You can leave out the "panic". Everyone upgraded. Appropriately. No need for the over-sensationalism.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  4. This is awesome by nctritech · · Score: 4, Insightful

    The more of these we find, the more secure OpenSSL will be. I hope we continue to find these kinds of problems and see them fixed. If open source has one strength, it's that when many skilled eyes DO converge on the code it can be tested and fixed far more quickly than a corporation with limited resources and only paid developers can do the same sort of debugging work. The trick is getting the eyes there in the first place.

    1. Re:This is awesome by iamgnat · · Score: 5, Insightful

      open source has one strength, it's that when many skilled eyes DO converge on the code it can be tested and fixed far more quickly

      Did you even read the summary? They believe that this flaw has existed since 1998. You have a very strange definition of "quickly" if 16 years falls into that category.

      I'm all for OSS, but people like you that continue to trot out this tripe aren't helping it. The benefit isn't that there all these mythical "skilled eyes" looking at the code, it's that you can look at the code.

    2. Re:This is awesome by evilviper · · Score: 4, Insightful

      If open source is so great, this flaw wouldn't have been around this long, would it?

      Closed source software is far worse, you just don't hear about it.

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
    3. Re:This is awesome by Dcnjoe60 · · Score: 5, Insightful

      I agree that 16 years for a fundamental flaw like this is bad, but how can you possibly know that closed source is no worse (or no better) than this? Closed-source software vendors are usually not very open about these problems.

      I agree 100%. The only reason this flaw is known is because the source code was available to review. Obviously, it would have been better if this were reviewed and caught sooner, but that ignores the fact that it was only caught because the source code was available. That seems to be a big plus.

      Also what is interesting is that even though the flaw has been there for 16 years, there are no known exploits of it. That would seem to dismiss the notion that open source security software is problematic because bad people can find exploits.

      Of course another explanation is that the flaw isn't any such thing and was intentional and because it was open source, certain government agencies will now lose the ability to exploit it.

      Regardless of how you look at it, it seems to be an advantage to open source.

    4. Re:This is awesome by js3 · · Score: 3, Insightful

      The more of these we find, the more secure OpenSSL will be. I hope we continue to find these kinds of problems and see them fixed. If open source has one strength, it's that when many skilled eyes DO converge on the code it can be tested and fixed far more quickly than a corporation with limited resources and only paid developers can do the same sort of debugging work. The trick is getting the eyes there in the first place.

      10 years ago someone said...

      "Opensource will eliminate all bugs, because the world can see the source". Doesn't matter if no one reads the source.

      --
      did you forget to take your meds?
    5. Re:This is awesome by nctritech · · Score: 5, Insightful

      If you've been following OpenSSL Heartbleed coverage, you know that the project has only had one full-time developer working on it. Since Heartbleed (a recent discovery, you'll recall) they've discovered more holes to close such as this one. I'd call less than two months since more eyes started staring at OpenSSL "quickly."

    6. Re:This is awesome by Anonymous Coward · · Score: 2, Insightful

      There are STILL open issues in Windows 8.1 that have existed since Win2000, that are actively being exploited today with no fix in sight. Major flaws that have survived supposed "complete rewrites" even though the steps to exploit are the exact same. There is only a large amount of shrill denial and burying heads in the sand. At least that aspect doesn't exist in open source.

    7. Re:This is awesome by rabtech · · Score: 3, Insightful

      It's actually a false dichotomy...

      The vast majority of software is poorly written, hacked-together junk written by dicks and idiots.

      Open Source *can* be slightly less terrible, but it's all still terrible.

      --
      Natural != (nontoxic || beneficial)
    8. Re:This is awesome by Desler · · Score: 3, Insightful

      Neither this bug or heartbleed were found by looking at the source code. They were found through binary analysis.

  5. How are people affected in their day to day lives? by tlhIngan · · Score: 3, Insightful

    This is a flaw, but it requires both ends use vulnerable OpenSSL versions. Which means your day-to-day life may or may not be affected that much.

    I mean, if you use iOS, OS X, or Windows, you're more than likely NOT using OpenSSL on the client side (except say, if you use Firefox on Windows) - since Apple and Microsoft have their own SSL implementations. If you have an Android phone or tablet, then yes, it's quite likely an issue, and while both are popular, people generally don't use them that much for data (iOS traffic, after 7 years, has finally dropped to below 50% of all mobile traffic out there, despite Android outselling iOS by a huge margin). And nevermind the oddball Linux user.

    So the real question is, how many people really ARE affected?

    Heartbleed affects everyone because it exposes server secrets irrespective of the client side. But this vulnerability is only really present if both ends use OpenSSL.

  6. Re: Key phrase of vulnerability : by AndroSyn · · Score: 3, Insightful

    How does LibreSSL fix users who do stupid things? This I'd like to know...