Heartleech: Automated OpenSSL private key extraction tool using Heartbleed

Re:Heartleech: Automated OpenSSL private key extraction tool... by makomk on Tuesday April 15, 2014 @09:51AM (#7591774)

It's quite easy to argue that actually. People pointed out that those Snort and other IDS rules were inadequate as soon as they were released, yet it hasn't stopped vendors from claiming they offer protection.

[ Parent | on HN ]

Re:Heartleech: Automated OpenSSL private key extraction tool... by clogston on Tuesday April 15, 2014 @03:33PM (#7593836)

"yet it hasn't stopped vendors from claiming they offer protection"

100% true. The argument Dan and others are trying to make is there are a lot of people caught in the cross-fire who have nothing to do with IDS-vendors claims.

[ Parent | on HN ]

Re:Heartleech: Automated OpenSSL private key extraction tool... by danielweber on Tuesday April 15, 2014 @12:05PM (#7592580)

I totally understand the desire to tweak the IDS vendors. Having spent a lot of time working for vendors in that space, they often need tweaking.

But I don't get the leap from "IDS vendors suck" to "I made a command-line tool so any idiot can suck down private keys from a server." If the idea was to show that the IDS rules sucked, then just release a slightly different version of the previous heartbleed testers that gets around it.

But that's not as much fun.

[ Parent | on HN ]