OpenSSL 'heartbleed' bug exposes memory blocks - including passwords.

Arksun

sr. member

Activity: 616

Merit: 250

Quote from: cooldgamer on April 09, 2014, 12:55:59 PM

Quote from: Arksun on April 09, 2014, 12:50:29 PM

Can anyone confirm whether Blockchain.info website was affected and whether passwords for that site need changing?

https://blog.blockchain.com/2014/04/08/important-statement-regarding-heartbleed-bug/

Sounds like I dont need to change the passwords then, great!

cooldgamer

legendary

Activity: 1218

Merit: 1003

We are the champions of the night

Quote from: Arksun on April 09, 2014, 12:50:29 PM

Can anyone confirm whether Blockchain.info website was affected and whether passwords for that site need changing?

https://blog.blockchain.com/2014/04/08/important-statement-regarding-heartbleed-bug/

DeathAndTaxes

donator

Activity: 1218

Merit: 1079

Gerald Davis

Quote from: Arksun on April 09, 2014, 12:50:29 PM

Can anyone confirm whether Blockchain.info website was affected and whether passwords for that site need changing?

http://filippo.io/Heartbleed/#blockchain.info

The site is not vulnerable at the current time however this tool can't determine if it was ever vulnerable. Only the site operator can advise that. Since there is a chance passwords could have been compromised it may be a good idea to change them. Although for any site which has real time access to Bitcoins I have to imagine if your password was compromised your coins would already be gone.

Arksun

sr. member

Activity: 616

Merit: 250

Can anyone confirm whether Blockchain.info website was affected and whether passwords for that site need changing?

kokojie

legendary

Activity: 1806

Merit: 1003

How did this bug happen? how CAN this type of bug happen? it's inexcusable. Using non-https in the case, was more secure than using https (with openssl). Is this a joke to the openssl programmers? the person responsible should commit Seppuku already if he were Japanese.

windpath

legendary

Activity: 1258

Merit: 1027

Checking your Bitcoin Core version of OpenSSL

Menu -> Help -> Debug Window

Robert Paulson

sr. member

Activity: 448

Merit: 250

Quote from: DeathAndTaxes on April 08, 2014, 05:04:03 PM

Quote from: Robert Paulson on April 08, 2014, 04:56:51 PM

SSL can now be considered as dead, this bug leaks the private SSL key of all the websites that use SSL.
even if they patch the server anyone who dumped enough of the server's memory would likely be able to recover the SSL private key of the server.

Generating a new key and cert as well as revoking the old cert takes less than an hour (honestly more like ten minutes but was being conservative). Of course many website were completely unaffected as they didn't use the compromised version of OpenSSL. BitSimple (among many other Bitcoin related sites) for example is unaffected.

revoking doesn't work with default settings (at least in firefox).

notice the second checkbox is false by default, meaning all an attacker needs to do to man in the middle an SSL session with a stolen certificate is to send firefox an RST packet when it tries to reach the OCSP server.
which is why as it stands today SSL can be considered broken.

dserrano5

legendary

Activity: 1974

Merit: 1029

Quote from: Hyena on April 09, 2014, 06:37:10 AM

http://filippo.io/Heartbleed/

Can this site also do localhost:8332 to check if your bitcoin RPC is affected?

That made me lol Cheesy

.

Well, no it can't.

Hyena

legendary

Activity: 2114

Merit: 1015

http://filippo.io/Heartbleed/

Can this site also do localhost:8332 to check if your bitcoin RPC is affected?

Bit_Happy

legendary

Activity: 2114

Merit: 1040

A Great Time to Start Something!

Quote from: mullick on April 08, 2014, 08:28:54 PM

Quote from: Bit_Happy on April 08, 2014, 05:27:32 PM

Quote from: DeathAndTaxes on April 08, 2014, 05:14:00 PM

Quote from: Bit_Happy on April 08, 2014, 05:06:41 PM

Does anyone know if Cryptsy updated yet?
EDIT:
We have updated all of our OpenSSL servers and our DDOS provider has also updated. More information here: http://blog.cryptsy.com

...or btc-e?
On April 6th
"We updated SSL certificate"
...That may have simply been expiring. Cannot tell what version of OpenSSL they are running.

I don't vouch for the accuracy of this test but it indicates no vulnerability
http://filippo.io/Heartbleed/#cryptsy.com

It says you need to know the hostname (i.e. server.domain.com) not just the domain name.
cryptsy tweeted about the update, but not sure about btc-e

We patched it about 13 hours ago now

Tweet was put out after the update was complete

Good you had a fast response.
This one was really serious, thanks.

mullick

legendary

Activity: 1064

Merit: 1002

Quote from: Bit_Happy on April 08, 2014, 05:27:32 PM

Quote from: DeathAndTaxes on April 08, 2014, 05:14:00 PM

Quote from: Bit_Happy on April 08, 2014, 05:06:41 PM

Does anyone know if Cryptsy updated yet?
EDIT:
We have updated all of our OpenSSL servers and our DDOS provider has also updated. More information here: http://blog.cryptsy.com

...or btc-e?
On April 6th
"We updated SSL certificate"
...That may have simply been expiring. Cannot tell what version of OpenSSL they are running.

I don't vouch for the accuracy of this test but it indicates no vulnerability
http://filippo.io/Heartbleed/#cryptsy.com

It says you need to know the hostname (i.e. server.domain.com) not just the domain name.
cryptsy tweeted about the update, but not sure about btc-e

We patched it about 13 hours ago now

Tweet was put out after the update was complete

gweedo

legendary

Activity: 1498

Merit: 1000

Quote from: DeathAndTaxes on April 08, 2014, 06:05:38 PM

Quote from: bitpop on April 08, 2014, 06:00:18 PM

Quote from: DeathAndTaxes on April 08, 2014, 05:24:15 PM

Quote from: awesomeami on April 08, 2014, 05:18:32 PM

https://bitcointalk.org/index.php?topic=562388.new#new
0.9.1 already released
update ASAP pls - just for sure

Most users have absolutely no reason to upgrade. SSL isn't used in the Bitcoin protocol.

Only users who use bitcoind RPC calls over SSL/TSL connection have any potential vulnerability.

Do you not use bitcoind RPC? Then there is no urgent need to upgrade.
Do you use bitcoind RPC but don't use SSL? Then there is no urgent need to upgrade.
Do you use bitcoind RPC over SSL? Then you should halt your bitcoind server and upgrade before restoring access.

On edit: Bad information. The payment protocol uses SSL any user could already be compromised if they used the new payment protocol "feature". Upgrade now or if you can't shutdown the client and don't restart it until such time as you can upgrade.

Isn't ssl used at the merchant? How's this effect our wallet?

SSL is used as both ends of the connection. I don't know enough about the new payment protocol "feature" to provide guidance on the scope and severity of a compromise. Since this is money we are talking about it is likely a good idea to be overly cautious.

Basically they are saying that SSL certificate could be compromised, which in turn could allow an attack slip his address into the payment protocol and you wouldn't know.

awesomeami

member

Activity: 98

Merit: 10

https://www.openssl.org/news/secadv_20140407.txt

best article about this bug http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html

Change ALL YOUR PASSWORDS on banking systems, gmail, FB, this forum, all httpS ...
(most paranoic - do it twice a day next 2 weeks - and don't forget them Tongue

)

Its 2 yo bug!!

http://heartbleed.com/

Quote

How to stop the leak?

As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use

Quote

What versions of the OpenSSL are affected?

Status of different versions:

   OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
   OpenSSL 1.0.1g is NOT vulnerable
   OpenSSL 1.0.0 branch is NOT vulnerable
   OpenSSL 0.9.8 branch is NOT vulnerable

Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

cr1776

legendary

Activity: 4228

Merit: 1313

Quote from: bitpop on April 08, 2014, 04:34:42 PM

This bug must be intentional

My thoughts too. Some three letter agency slipped it in.

DeathAndTaxes

donator

Activity: 1218

Merit: 1079

Gerald Davis

Quote from: bitpop on April 08, 2014, 06:00:18 PM

Quote from: DeathAndTaxes on April 08, 2014, 05:24:15 PM

Quote from: awesomeami on April 08, 2014, 05:18:32 PM

https://bitcointalk.org/index.php?topic=562388.new#new
0.9.1 already released
update ASAP pls - just for sure

Most users have absolutely no reason to upgrade. SSL isn't used in the Bitcoin protocol.

Only users who use bitcoind RPC calls over SSL/TSL connection have any potential vulnerability.

Do you not use bitcoind RPC? Then there is no urgent need to upgrade.
Do you use bitcoind RPC but don't use SSL? Then there is no urgent need to upgrade.
Do you use bitcoind RPC over SSL? Then you should halt your bitcoind server and upgrade before restoring access.

On edit: Bad information. The payment protocol uses SSL any user could already be compromised if they used the new payment protocol "feature". Upgrade now or if you can't shutdown the client and don't restart it until such time as you can upgrade.

Isn't ssl used at the merchant? How's this effect our wallet?

SSL is used as both ends of the connection. I don't know enough about the new payment protocol "feature" to provide guidance on the scope and severity of a compromise. Since this is money we are talking about it is likely a good idea to be overly cautious.

bitpop

legendary

Activity: 2912

Merit: 1060

Quote from: DeathAndTaxes on April 08, 2014, 05:24:15 PM

Quote from: awesomeami on April 08, 2014, 05:18:32 PM

https://bitcointalk.org/index.php?topic=562388.new#new
0.9.1 already released
update ASAP pls - just for sure

Most users have absolutely no reason to upgrade. SSL isn't used in the Bitcoin protocol.

Only users who use bitcoind RPC calls over SSL/TSL connection have any potential vulnerability.

Do you not use bitcoind RPC? Then there is no urgent need to upgrade.
Do you use bitcoind RPC but don't use SSL? Then there is no urgent need to upgrade.
Do you use bitcoind RPC over SSL? Then you should halt your bitcoind server and upgrade before restoring access.

On edit: Bad information. The payment protocol uses SSL any user could already be compromised if they used the new payment protocol "feature". Upgrade now or if you can't shutdown the client and don't restart it until such time as you can upgrade.

Isn't ssl used at the merchant? How's this effect our wallet?

turio

newbie

Activity: 14

Merit: 0

Quote from: awesomeami on April 08, 2014, 05:18:32 PM

https://bitcointalk.org/index.php?topic=562388.new#new
0.9.1 already released
update ASAP pls - just for sure

thank you I am updating now

Bit_Happy

legendary

Activity: 2114

Merit: 1040

A Great Time to Start Something!

Quote from: DeathAndTaxes on April 08, 2014, 05:14:00 PM

Quote from: Bit_Happy on April 08, 2014, 05:06:41 PM

Does anyone know if Cryptsy updated yet?
EDIT:
We have updated all of our OpenSSL servers and our DDOS provider has also updated. More information here: http://blog.cryptsy.com

...or btc-e?
On April 6th
"We updated SSL certificate"
...That may have simply been expiring. Cannot tell what version of OpenSSL they are running.

I don't vouch for the accuracy of this test but it indicates no vulnerability
http://filippo.io/Heartbleed/#cryptsy.com

It says you need to know the hostname (i.e. server.domain.com) not just the domain name.
cryptsy tweeted about the update, but not sure about btc-e

DeathAndTaxes

donator

Activity: 1218

Merit: 1079

Gerald Davis

Quote from: awesomeami on April 08, 2014, 05:18:32 PM

https://bitcointalk.org/index.php?topic=562388.new#new
0.9.1 already released
update ASAP pls - just for sure

Most users have absolutely no reason to upgrade. SSL isn't used in the Bitcoin protocol.

Only users who use bitcoind RPC calls over SSL/TSL connection have any potential vulnerability.

Do you not use bitcoind RPC? Then there is no urgent need to upgrade.
Do you use bitcoind RPC but don't use SSL? Then there is no urgent need to upgrade.
Do you use bitcoind RPC over SSL? Then you should halt your bitcoind server and upgrade before restoring access.

On edit: Bad information. The payment protocol uses SSL any user could already be compromised if they used the new payment protocol "feature". Upgrade now or if you can't shutdown the client and don't restart it until such time as you can upgrade.

awesomeami

member

Activity: 98

Merit: 10

https://bitcointalk.org/index.php?topic=562388.new#new
0.9.1 already released
update ASAP pls - just for sure

Topic: OpenSSL 'heartbleed' bug exposes memory blocks - including passwords. (Read 5230 times)