News for hackers. Stuff that matters.

A comment on Universal SSL. Parent comment

Re:Universal SSL by peterwwillis on Monday September 29, 2014 @04:26PM (#8385065)
Yes, you could get the data going to and from the clients, which is most of the important user data. The big problem is when your SSL/http/whatever is being terminated on the app server itself, exposing things like database access, SANs, etc.
[ Parent | on HN ]
Re:Universal SSL by X-Istence on Monday September 29, 2014 @07:38PM (#8385986)
No, it wouldn't expose those things. It would only expose things that OpenSSL itself had allocated/deallocated in that single process due to the way it was saving memory allocations for later re-use...
[ Parent | on HN ]
Re:Universal SSL by peterwwillis on Tuesday September 30, 2014 @10:27AM (#8388302)
You're right. I meant in the case of a code execution exploit in the openssl layer, those things would be exposed if they were all on the same host/network.
[ Parent | on HN ]