HeartBleed

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

read more @ http://heartbleed.com/

I found this infographic that was quite good at explaining what all the fuss is about.

I am sure many of you are running around patching systems affected by the recent OpenSSL vulnerability. I wanted to share some sites that were helpful in determining our focus on remediation.

I recommend you follow the following strategy in your remediation:

1. Identify the systems that are internet facing that are vulnerable. Apply patches, or upgrade OpenSSL.
2. Address systems In your trusted network with the vulnerability.
3. Don’t forget about appliances such as Load Balancing devices or security devices such as email encryption devices etc.
4. Make a point of reviewing other security issues, remember this should be done on a regular basis in line with your security policies.
5. After verifying the systems have been remediated, revoke and reissue new SSL certs to install on your devices.
6. Take the time to send out a communication  to your end users, provide guidance on existing security policies and best practices.

I found this tool useful for scanning webserver(s) to check for the “Heartbleed” OpenSSL vulnerability:

https://www.ssllabs.com/ssltest/

If you would like to audit internal systems, I would recommend using NMAP:

http://nmap.org/nsedoc/scripts/ssl-heartbleed.html

If you are an Android user, there is a free tool to scan your device for vulnerabilities in applications:

https://play.google.com/store/apps/details?id=com.bblabs.heartbleedscanner

To find vendor notifications in response to this issue, i recommend checking the following links:

Internet Storm Center:  (read the comments for up to date links)

https://isc.sans.edu/forums/diary/Heartbleed+vendor+notifications/17929/2/

Cert has a list of vendor notifications: http://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=720951&SearchOrder=4

Here is the take away:

• Netscaler is not affected:  http://support.citrix.com/article/CTX140605
• Citrix is not affected:   http://support.citrix.com/article/CTX140605
• Cisco has some issues: (IP phones and they are still working on reviewing all product lines)    https://tools.cisco.com/security/center/publicationListing.xhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
• Hp System Management homepage is vulnerable: (hp recently shared this page with our vendors)

http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04239413-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

• VMWARE ESXi 5.5 is vulnerable:   http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2076225
• F5 LTM is vulnerable: http://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html

 

A little comedy for the other geeks out there: https://xkcd.com/1353/