News for hackers. Stuff that matters.

A comment on Hijacking user sessions with the Heartbleed vulnerability.

Re:Hijacking user sessions with the Heartbleed vulnerability by willvarfar on Tuesday April 08, 2014 @02:41PM (#7555164)
A malicious server can also read the memory of a client using the same heartbleed vulnerability.

So the -NSA-mafia can go get the private key from a vulnerable server, MitM its clients, and attack those clients too.

Nasty stuff. And in the last day, even those agencies that didn't know about the vulnerability beforehand have likely spidered the entire web scraping everyone's keys just-in-case.

[ Parent | on HN ]
Re:Hijacking user sessions with the Heartbleed vulnerability by justincormack on Tuesday April 08, 2014 @03:12PM (#7555328)
Anyone seen any evidence of attempts to do this, or set up honeypots?
[ Parent | on HN ]
Re:Hijacking user sessions with the Heartbleed vulnerability by kevjiang on Tuesday April 08, 2014 @08:46PM (#7557049)
In fact, an attacker doesn't even need to steal the private key.. Heartbeats can be sent before certificate authentication takes place.
[ Parent | on HN ]