News for hackers. Stuff that matters.

A comment on Heartleech: Automated OpenSSL private key extraction tool using Heartbleed. Parent comment

Re:Heartleech: Automated OpenSSL private key extraction tool... by tptacek on Tuesday April 15, 2014 @04:51PM (#7594196)
I don't think I had a problem with "heartleech" until I read this comment. What exactly does Snort's TLS decoding have to do with extracting private keys from servers? That's not the bug. The bug is OpenSSL leaking memory when it receives a malformed TLS heartbeat. You could have demonstrated that without publishing "find_private_key()".

I think you published this because it was fun to write. "Auto pwn", as you call it, has nothing to do with convincing Snort to do anything.

I don't believe you agree with Daniel Weber's argument at all. Don't dodge it by making things up. Engage with it directly. I wouldn't think it would be that difficult for you to knock down.

[ Parent | on HN ]
Re:Heartleech: Automated OpenSSL private key extraction tool... by robertgraham on Tuesday April 15, 2014 @07:35PM (#7595009)
Because Snort's signatures can't detect 'heartleech'.

But most other IDSs can, such as Bro.

Unless there is a tool that demonstrates this, people won't believe that there is a difference between Snort and Bro, because existing tools don't show a difference.

[ Parent | on HN ]
Re:Heartleech: Automated OpenSSL private key extraction tool... by tptacek on Tuesday April 15, 2014 @07:43PM (#7595047)
You didn't address what I wrote. The demonstration didn't require the extraction of private key material from servers, because that's not the bug. The difference between Bro and Snort has nothing to do with private key material.
[ Parent | on HN ]
Re:Heartleech: Automated OpenSSL private key extraction tool... by robertgraham on Thursday April 17, 2014 @09:39PM (#7607560)
People are good at convincing themselves there is no problem. Vendors are good at convincing people there is no problem. The demonstration has to hit them over the head with the obviousness of the exploit. If the private-key pops up automatically, and a sensor didn't detect it, they have to believe. Otherwise, when the sensor doesn't fire, they'll believe that the exploit is at fault.
[ Parent | on HN ]