Heartbleed - Revision history

AAssadzadeh at 19:16, 13 December 2024

2024-12-13T19:16:33Z

ISijamhodzic: /* Simmilarities to Cloudbleed */

2023-12-22T19:03:16Z

Simmilarities to Cloudbleed

← Older revision		Revision as of 19:03, 22 December 2023
Line 139:		Line 139:
	In order to prevent similar mistakes and vulneratbilites, OWASP provides numerous guides about secure coding practices, including checklists for input validation, session management, data protection, error handling and logging, etc. <ref name="OWASPGuide">OWASP, ''OWASP Secure Coding Practices-Quick Reference Guide'', https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/ (accessed December 22, 2023).</ref>		In order to prevent similar mistakes and vulneratbilites, OWASP provides numerous guides about secure coding practices, including checklists for input validation, session management, data protection, error handling and logging, etc. <ref name="OWASPGuide">OWASP, ''OWASP Secure Coding Practices-Quick Reference Guide'', https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/ (accessed December 22, 2023).</ref>

	==~~Simmilarities~~ to Cloudbleed==		==Similarities to Cloudbleed==
	Cloudbleed was a major security bug discovered in 2017 within the infrastructure of a major IT company Cloudflare. This bug, much like Heartbleed, exposed sensitive information due to a buffer overflow issue, caused by a human error in the code. The leakage occured under certain circumstances involving certain HTML content and Cloudflare features. Much like Heartbleed, Cloudbleed demonstrated the possibility of human error in critical software. <ref name="CloudflareGraham">Cloudflare, ''Incident report on memory leak caused by Cloudflare parser bug'', https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/. (accessed December 22, 2023).</ref> <ref name="CloudflarePrince">Cloudflare, ''Quantifying the Impact of "Cloudbleed"'', https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/. (accessed December 22, 2023).</ref>		Cloudbleed was a major security bug discovered in 2017 within the infrastructure of a major IT company Cloudflare. This bug, much like Heartbleed, exposed sensitive information due to a buffer overflow issue, caused by a human error in the code. The leakage occured under certain circumstances involving certain HTML content and Cloudflare features. Much like Heartbleed, Cloudbleed demonstrated the possibility of human error in critical software. <ref name="CloudflareGraham">Cloudflare, ''Incident report on memory leak caused by Cloudflare parser bug'', https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/. (accessed December 22, 2023).</ref> <ref name="CloudflarePrince">Cloudflare, ''Quantifying the Impact of "Cloudbleed"'', https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/. (accessed December 22, 2023).</ref>

	==References==		==References==

ISijamhodzic at 18:58, 22 December 2023

2023-12-22T18:58:30Z

← Older revision		Revision as of 18:58, 22 December 2023
Line 138:		Line 138:
	=== Secure Coding Practices ===		=== Secure Coding Practices ===
	In order to prevent similar mistakes and vulneratbilites, OWASP provides numerous guides about secure coding practices, including checklists for input validation, session management, data protection, error handling and logging, etc. <ref name="OWASPGuide">OWASP, ''OWASP Secure Coding Practices-Quick Reference Guide'', https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/ (accessed December 22, 2023).</ref>		In order to prevent similar mistakes and vulneratbilites, OWASP provides numerous guides about secure coding practices, including checklists for input validation, session management, data protection, error handling and logging, etc. <ref name="OWASPGuide">OWASP, ''OWASP Secure Coding Practices-Quick Reference Guide'', https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/ (accessed December 22, 2023).</ref>

			==Simmilarities to Cloudbleed==
			Cloudbleed was a major security bug discovered in 2017 within the infrastructure of a major IT company Cloudflare. This bug, much like Heartbleed, exposed sensitive information due to a buffer overflow issue, caused by a human error in the code. The leakage occured under certain circumstances involving certain HTML content and Cloudflare features. Much like Heartbleed, Cloudbleed demonstrated the possibility of human error in critical software. <ref name="CloudflareGraham">Cloudflare, ''Incident report on memory leak caused by Cloudflare parser bug'', https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/. (accessed December 22, 2023).</ref> <ref name="CloudflarePrince">Cloudflare, ''Quantifying the Impact of "Cloudbleed"'', https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/. (accessed December 22, 2023).</ref>

	==References==		==References==

ISijamhodzic: /* Consequences */

2023-12-22T18:51:11Z

Consequences

← Older revision		Revision as of 18:51, 22 December 2023
Line 122:		Line 122:

	A great asset which built out of this situation, is that service providers that suffered from the Heartbleed Bug updated software and enhanced the security power. <ref name="Synopsys" />		A great asset which built out of this situation, is that service providers that suffered from the Heartbleed Bug updated software and enhanced the security power. <ref name="Synopsys" />

			A specific case of the Hearbleed expolitation was done in Canada, where a teenager had stolen 900 social security numbers in a matter of hours. <ref name="HeartbleedCanada"> Heise, Daniel AJ Sokolov ''Heartbleed: Datendiebstahl beim kanadischen Finanzamt'' https://www.heise.de/news/Heartbleed-Datendiebstahl-beim-kanadischen-Finanzamt-2169832.html. (accessed December 22, 2023).</ref>

	In addition to this, Heartbleed lead to more conspiracy theories about the NSA, as anonymous sources have claimed that the NSA has been exploiting the vulnerability for two years prior to the public announcment. <ref name="MoreHeartbleed"> Bruce Schneier ''More on Heartbleed'' https://www.schneier.com/blog/archives/2014/04/more_on_heartbl.html. (accessed December 22, 2023).</ref>		In addition to this, Heartbleed lead to more conspiracy theories about the NSA, as anonymous sources have claimed that the NSA has been exploiting the vulnerability for two years prior to the public announcment. <ref name="MoreHeartbleed"> Bruce Schneier ''More on Heartbleed'' https://www.schneier.com/blog/archives/2014/04/more_on_heartbl.html. (accessed December 22, 2023).</ref>

ISijamhodzic: /* Consequences */

2023-12-22T18:48:24Z

Consequences

← Older revision		Revision as of 18:48, 22 December 2023
Line 122:		Line 122:

	A great asset which built out of this situation, is that service providers that suffered from the Heartbleed Bug updated software and enhanced the security power. <ref name="Synopsys" />		A great asset which built out of this situation, is that service providers that suffered from the Heartbleed Bug updated software and enhanced the security power. <ref name="Synopsys" />

			In addition to this, Heartbleed lead to more conspiracy theories about the NSA, as anonymous sources have claimed that the NSA has been exploiting the vulnerability for two years prior to the public announcment. <ref name="MoreHeartbleed"> Bruce Schneier ''More on Heartbleed'' https://www.schneier.com/blog/archives/2014/04/more_on_heartbl.html. (accessed December 22, 2023).</ref>

	== Solution for the Heartbleed bug ==		== Solution for the Heartbleed bug ==

ISijamhodzic: /* Background */

2023-12-22T18:44:41Z

Background

← Older revision		Revision as of 18:44, 22 December 2023
Line 18:		Line 18:
	* To keep the session alive, the web-browser sends heartbeat requests which are processed by the server		* To keep the session alive, the web-browser sends heartbeat requests which are processed by the server
	* Classified as a [[Buffer Overflows]] Vulnerability		* Classified as a [[Buffer Overflows]] Vulnerability
	* Vulnerable code written by a German graduate student in 2011, approved by a British consultant <ref name="HumanSideHeartbleed"> Bruce Schneier ''The Human Side of Heartbleed'' https://www.schneier.com/blog/archives/2014/06/the_human_side_.html. (accessed December 22, 2023).</ref>
	* Heartbleed discovered in 2014 by a Neel Mehta, a member of Google's security team. <ref name="HumanSideHeartbleed" />

	=== Heartbeat ===		=== Heartbeat ===
Line 36:		Line 35:
	=== Heartbleed (CVE-2014-0160)===		=== Heartbleed (CVE-2014-0160)===

			* Vulnerable code written by a German graduate student in 2011, approved by a British consultant <ref name="HumanSideHeartbleed"> Bruce Schneier ''The Human Side of Heartbleed'' https://www.schneier.com/blog/archives/2014/06/the_human_side_.html. (accessed December 22, 2023).</ref>
			* Heartbleed discovered in 2014 by a Neel Mehta, a member of Google's security team. <ref name="HumanSideHeartbleed" />
	* Choose heartbeat request size as a minimum and claim it to the maximum		* Choose heartbeat request size as a minimum and claim it to the maximum
	* The heartbeat request can be executed multiple times in a row		* The heartbeat request can be executed multiple times in a row

ISijamhodzic: /* Background */

2023-12-22T18:44:05Z

Background

← Older revision		Revision as of 18:44, 22 December 2023
Line 19:		Line 19:
	* Classified as a [[Buffer Overflows]] Vulnerability		* Classified as a [[Buffer Overflows]] Vulnerability
	* Vulnerable code written by a German graduate student in 2011, approved by a British consultant <ref name="HumanSideHeartbleed"> Bruce Schneier ''The Human Side of Heartbleed'' https://www.schneier.com/blog/archives/2014/06/the_human_side_.html. (accessed December 22, 2023).</ref>		* Vulnerable code written by a German graduate student in 2011, approved by a British consultant <ref name="HumanSideHeartbleed"> Bruce Schneier ''The Human Side of Heartbleed'' https://www.schneier.com/blog/archives/2014/06/the_human_side_.html. (accessed December 22, 2023).</ref>
	* Heartbleed discovered in 2014 by a Neel Mehta, a member of Google's security team.		* Heartbleed discovered in 2014 by a Neel Mehta, a member of Google's security team. <ref name="HumanSideHeartbleed" />

	=== Heartbeat ===		=== Heartbeat ===

ISijamhodzic: /* Background */

2023-12-22T18:43:47Z

Background

← Older revision		Revision as of 18:43, 22 December 2023
Line 19:		Line 19:
	* Classified as a [[Buffer Overflows]] Vulnerability		* Classified as a [[Buffer Overflows]] Vulnerability
	* Vulnerable code written by a German graduate student in 2011, approved by a British consultant <ref name="HumanSideHeartbleed"> Bruce Schneier ''The Human Side of Heartbleed'' https://www.schneier.com/blog/archives/2014/06/the_human_side_.html. (accessed December 22, 2023).</ref>		* Vulnerable code written by a German graduate student in 2011, approved by a British consultant <ref name="HumanSideHeartbleed"> Bruce Schneier ''The Human Side of Heartbleed'' https://www.schneier.com/blog/archives/2014/06/the_human_side_.html. (accessed December 22, 2023).</ref>
			* Heartbleed discovered in 2014 by a Neel Mehta, a member of Google's security team.

	=== Heartbeat ===		=== Heartbeat ===

ISijamhodzic: /* Background */

2023-12-22T18:42:54Z

Background

← Older revision		Revision as of 18:42, 22 December 2023
Line 18:		Line 18:
	* To keep the session alive, the web-browser sends heartbeat requests which are processed by the server		* To keep the session alive, the web-browser sends heartbeat requests which are processed by the server
	* Classified as a [[Buffer Overflows]] Vulnerability		* Classified as a [[Buffer Overflows]] Vulnerability
	* Vulnerable code written by a German graduate student in 2011, approved by a British consultant		* Vulnerable code written by a German graduate student in 2011, approved by a British consultant <ref name="HumanSideHeartbleed"> Bruce Schneier ''The Human Side of Heartbleed'' https://www.schneier.com/blog/archives/2014/06/the_human_side_.html. (accessed December 22, 2023).</ref>

	=== Heartbeat ===		=== Heartbeat ===

ISijamhodzic: /* Background */

2023-12-22T18:41:58Z

Background

← Older revision		Revision as of 18:41, 22 December 2023
Line 18:		Line 18:
	* To keep the session alive, the web-browser sends heartbeat requests which are processed by the server		* To keep the session alive, the web-browser sends heartbeat requests which are processed by the server
	* Classified as a [[Buffer Overflows]] Vulnerability		* Classified as a [[Buffer Overflows]] Vulnerability
			* Vulnerable code written by a German graduate student in 2011, approved by a British consultant

	=== Heartbeat ===		=== Heartbeat ===
Line 43:		Line 44:
	* Web server allocates a dataslot of 64 KiB and copies the message ‘hello’ in the first place. The rest of the 65536 - ‘hello’ size is appended with data in the RAM.		* Web server allocates a dataslot of 64 KiB and copies the message ‘hello’ in the first place. The rest of the 65536 - ‘hello’ size is appended with data in the RAM.
	* The Web server responds with the filled 64 KiB dataslot (including content of RAM).		* The Web server responds with the filled 64 KiB dataslot (including content of RAM).


	== Attack ==		== Attack ==