Pak Info Zone: Security flaws

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">--</div><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="t6sg3ljc8x" href="http://www.cartoonink.com/wp-content/uploads/2014/04/Heartbleed.jpg" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><img border="0" height="136" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_QbAEJanxYJ86J5Wck7JA8z_S7ObVddNaURckC5h-YMh3okLDJdCW9w9kfZgGwW3HwFusQxB0uhFWO6aqHUFZJ-9T-IVL4kcr6RpfU6t91EEYYA3Vei6-tf3DZaNyXZs9n3OfIaiATbWB/s1600/Heartbleed.jpg" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="200" /></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"> </div>[UPDATED 2014-04-18 ~11:30 AM ET. AgileBits has created a lovely Heartbleed testing page I recommend. It offers advice as well as results. Thanks to my friendly colleague Al Varnell for pointing it out!] [UPDATED 2014-04-17 ~11:00 AM ET. A link to Mashable's list of affected websites was added.] This is week two of the Heartbleed bug and its ramifications. A lot has been learned. A lot is still happening. A lot more problems are still to come. I'm extremely disappointed that few websites have directly addressed this problem and kept their customers informed. Apparently, security is still considered a minor inconvenience to website administrators, with a wide variety of responses to the Heartbleed security hole, as you'll see ahead. TEST PAGES Thankfully, there are now some very good resources for finding out whether specific websites remain affected. Here is a list of six pages I know of where you can test any website against the Heartbleed bug. Try them in the order of usefulness I've provided below. If one test errors out, try the next one. <a href="http://watchtower.agilebits.com/" style="color: #d6a0b6; text-decoration: none;">http://watchtower.agilebits.com</a> <a href="https://www.ssllabs.com/ssltest/" style="color: #d6a0b6; text-decoration: none;">https://www.ssllabs.com/ssltest/</a> <div style="background-color: white; color: #0d03ee; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"> </div><div style="background-color: white; color: #0d03ee; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><a href="https://filippo.io/Heartbleed" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">https://filippo.io/Heartbleed</a>/</div> <a data-jsb_prepared="olpud0v05b" href="http://www.digicert.com/help/" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">http://www.digicert.com/help/</a> <a data-jsb_prepared="5iqb972fqb" href="http://heartbleed.criticalwatch.com/" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">http://heartbleed.criticalwatch.com</a> <a data-jsb_prepared="w5cdbbpkgm" href="https://lastpass.com/heartbleed/" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">https://lastpass.com/heartbleed/</a> Thanks to <a data-jsb_prepared="3kbsowrs8i" href="http://krebsonsecurity.com/2014/04/heartbleed-bug-what-can-you-do/" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">Brian Krebs</a> for getting the ball rolling collecting these sites. I'll add more to this list as I find them. Note that using these test pages can be annoying and disconcerting. On some test pages, I ran into errors of various sorts about 50% of the time. TEST RESULTS Fortunately, lists of FAILed websites are showing up on the net, saving us some time and trouble. Here is one at Github, listing affected websites as of April 8th, 2014, the day after the SSL security hole was made public. Scroll down its page to 'Overview' to see the list: <a data-jsb_prepared="9b9dteehlh" href="https://github.com/musalbas/heartbleed-masstest" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">https://github.com/musalbas/heartbleed-masstest</a> NOTE: Many of the sites on this out-of-date list have now been patched! Yahoo, for example, made a big deal out of patching its website in a hurry. Mashable has also provided a listing of affected websites here. Note that it is also out-of-date: <a data-jsb_prepared="h2g34lpam1" href="http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/</a> At the time I wrote this article, many sites had still not been patched. Here's one unhappy example:  <div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">hypovereinsbank.de</div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"> </div><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="66vi8vogdu" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNEIMMsUjQmA9K-R8MtFzeNU7x1rDjn0cA52yIsnVAT_zQ08JgzyfgBsF6kgGCX0Jiu693-US8klPHeCp3v7vAv-iJOhqjstTYojoYel8jkx-xetm1545kT8dbY7tcEJZuvktrZkOiqfgK/s1600/Istanbul+Unpatched.png" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="178" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNEIMMsUjQmA9K-R8MtFzeNU7x1rDjn0cA52yIsnVAT_zQ08JgzyfgBsF6kgGCX0Jiu693-US8klPHeCp3v7vAv-iJOhqjstTYojoYel8jkx-xetm1545kT8dbY7tcEJZuvktrZkOiqfgK/s1600/Istanbul+Unpatched.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="320" /></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNEIMMsUjQmA9K-R8MtFzeNU7x1rDjn0cA52yIsnVAT_zQ08JgzyfgBsF6kgGCX0Jiu693-US8klPHeCp3v7vAv-iJOhqjstTYojoYel8jkx-xetm1545kT8dbY7tcEJZuvktrZkOiqfgK/s1600/Istanbul+Unpatched.png">Click to enlarge the image for viewing</a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"> </div>This bank kindly patched their German website, but NOT their Turkish website! Ouch! And so forth. NOW WHAT? So! Are we ready to change our passwords at all the websites that verify as having patched their OpenSSL implementations? Yes! Do it! But! There's another problem! Remember how I pointed out last week that phishing is going to result from the Heartbleed bug? The phishing problem may become doubly bad: THE OTHER SHOE DROPS <a data-jsb_prepared="55vqve6im8" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9mJuLM2nrsk-T-rpR4sUdMA_I1dh3iiQcKyEJH7fGOEMCXsJm4353-oo2_Cqnt0hj4_p2H4goXWiKssRZjkjyDhJMH1BI1bscIL2leR0CAR0X8VBrtC8-CWYAYKv7Fz-quWNzA3BkhAwp/s1600/the_other_shoe_drops.png" imageanchor="1" rel="noreferrer" style="background-color: white; clear: right; color: #d6a0b6; float: right; font-family: Georgia, Times, serif; font-size: 13px; font-weight: bold; line-height: 18.200000762939453px; margin-bottom: 1em; margin-left: 1em; text-decoration: none;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9mJuLM2nrsk-T-rpR4sUdMA_I1dh3iiQcKyEJH7fGOEMCXsJm4353-oo2_Cqnt0hj4_p2H4goXWiKssRZjkjyDhJMH1BI1bscIL2leR0CAR0X8VBrtC8-CWYAYKv7Fz-quWNzA3BkhAwp/s1600/the_other_shoe_drops.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="185" /></a> Because, as I pointed out last week, Heartbleed can allow the cleartext robbery of website security certificates, ALL security certificates at affected sites MUST BE REVOKED and REPLACED. Why? Because with a stolen SSL security certificate, a hacker can pretend to 'officially' BE the website from which the certificate was stolen! That's VERY bad and will lead to lots of troubles. It's also ignorant, lazy and cheapskate of the website's administrators. It turns out that remarkably few websites have so far revoked their potentially stolen security certificates! Welcome to our modern world of bad biznizz. :-P Insert your favorite expletives here: [_____] Let's use an example! HAPPY RESULTS Use a GOOD web browser that actually CHECKS Internet security certificates for credibility. One such browser is good old AppleSafari! Bravo Apple! Each time you visit a website, Safari checks the security certificate for that website against a number of factors. One of them is whether that certificate is on aCertificate Revocation List (CRL).  <a data-jsb_prepared="m0fx1krsdv" href="http://en.wikipedia.org/wiki/Revocation_list" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">http://en.wikipedia.org/wiki/Revocation_list</a> When you visit a website that has had its security certificate revoked, you get a message in Safari! This past week, mentor Steve Gibson very kindly set up the perfect place to show what it looks like when you run into a revoked security certificate. Travel here to see Steve's demonstration: <a data-jsb_prepared="121iob7hil" href="https://www.grc.com/revocation.htm" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">https://www.grc.com/revocation.htm</a> In a box, slightly down the page, you'll see his test page link. Click on it: <a data-jsb_prepared="mv9l0x6dzv" href="https://revoked.grc.com/" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">https://revoked.grc.com</a> What you'll see in Safari is: <div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="egy5v4a81u" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY1FYH6r_Rr4lpqOARFjjOoDJB_QjpFAcR-8wAL_8NDsilJKMU-6_wLj-vg_ZZ6ejE_iCTBJRG_qLj0bbFSZOH0eLxiCfluZbapFPiulhPxIHkA3viuuij9b9CI720XWZGZXr06nuXMtMt/s1600/INVALID.png" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="211" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY1FYH6r_Rr4lpqOARFjjOoDJB_QjpFAcR-8wAL_8NDsilJKMU-6_wLj-vg_ZZ6ejE_iCTBJRG_qLj0bbFSZOH0eLxiCfluZbapFPiulhPxIHkA3viuuij9b9CI720XWZGZXr06nuXMtMt/s1600/INVALID.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="320" /></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY1FYH6r_Rr4lpqOARFjjOoDJB_QjpFAcR-8wAL_8NDsilJKMU-6_wLj-vg_ZZ6ejE_iCTBJRG_qLj0bbFSZOH0eLxiCfluZbapFPiulhPxIHkA3viuuij9b9CI720XWZGZXr06nuXMtMt/s1600/INVALID.png">Click to enlarge the image for viewing</a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"> </div>"Invalid" If you then click on the 'Show Certificate' button, you will see this: <div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="96c2g1ws8y" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh62BXKZPBXbhiQRvyQO9Swza_KZXd8DZx4pGEWoVCsmebJAJuT74Wa8PUsr-gZcJqz3iKXRcY9G1y0eWK51vm6tGqOrgI3eHpXYQqhyL1r_8jjWWaXFHb8bnRPw4tPwqcyTk7HznT1EwPs/s1600/REVOKED.png" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="221" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh62BXKZPBXbhiQRvyQO9Swza_KZXd8DZx4pGEWoVCsmebJAJuT74Wa8PUsr-gZcJqz3iKXRcY9G1y0eWK51vm6tGqOrgI3eHpXYQqhyL1r_8jjWWaXFHb8bnRPw4tPwqcyTk7HznT1EwPs/s1600/REVOKED.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="320" /></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh62BXKZPBXbhiQRvyQO9Swza_KZXd8DZx4pGEWoVCsmebJAJuT74Wa8PUsr-gZcJqz3iKXRcY9G1y0eWK51vm6tGqOrgI3eHpXYQqhyL1r_8jjWWaXFHb8bnRPw4tPwqcyTk7HznT1EwPs/s1600/REVOKED.png">Click to enlarge the image for viewing</a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"> </div>"Revoked" Therefore, you hit the 'Cancel' button and leave the site. There's something profoundly wrong with it, danger, danger. Do not go there. Thank you Safari! <a data-jsb_prepared="yrgb7s5n7o" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTHuMotWKzC9fHV4mOWj4TE9REk1-_koaZ4xslzUkGOUUM8y2Xvy-l4WCQCTXeAZB9F0rzdg0eeRorgJtFXLX0DbVaVW8PV_jSGZlMYonEqeAzZso8-0MODQI1dCZSjyPHWfME8LcqCSyn/s1600/this_house_has_rats.png" imageanchor="1" rel="noreferrer" style="background-color: white; clear: right; color: #d6a0b6; float: right; font-family: Georgia, Times, serif; font-size: 13px; font-weight: bold; line-height: 18.200000762939453px; margin-bottom: 1em; margin-left: 1em; text-decoration: none;"><img border="0" height="131" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTHuMotWKzC9fHV4mOWj4TE9REk1-_koaZ4xslzUkGOUUM8y2Xvy-l4WCQCTXeAZB9F0rzdg0eeRorgJtFXLX0DbVaVW8PV_jSGZlMYonEqeAzZso8-0MODQI1dCZSjyPHWfME8LcqCSyn/s1600/this_house_has_rats.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="200" /></a>SAD RESULTS Let's say we live in Turkey and get an email we believe is from the Istanbul branch of  HypoVereinsbank, where we have all our life savings stored. The email message says something like: <blockquote class="tr_bq" style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">Dear Valued Customer,  We are offering a new 5% back on purchases feature to select account holders. To sign up for this new perk, please log into your<a data-jsb_prepared="flbdoanxf7" href="http://192.168.0.254/" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">HypoVereinsbank.co.tr</a> account and click the 'Join the 5% Back Club' button on the  page. Hurry now! Limited time offer! Don't let this deal pass you by! Prices do not include shipping and handling.</blockquote>Great! A deal! They offered up the link to their website within the message! How convenient. [If you check out the actual web address behind 'HypoVereinsbank account', you'll find that I've faked a different IP address that is NOT HypoVereinsbank! In reality, I've provided a LAN IP link that goes nowhere on the Internet, making in innocuous. But I could put anything there. Note that I am NOT picking on HypoVereinsbank in Turkey. I'm only using them as a valid example of a bank that had not patched the Heartbleed bug at the time of this writing.] So we click the link to HypoVereinsbank.co.tr. We're sent to the FAKE website for the bank. We're presented with everything looking just perfect and fine. Safari sees NO problems! The stolen, unrevoked certificate is presented to Safari, all his happy. UH OH. Then we log in, our ID and password are stolen, we possibly get asked a bunch of other personal identity questions in order to sign up for the FAKE 5% Back Club offer. We have been PWNed. THEREFORE: It's important that ALL Heartbleed bug affected websites revoke their old security certificates and get new certificates. ALL. Enough of that nightmare for today. CONCLUSION, for now: 1) Check out what websites have been affected by the Heartbleed bug. 2) Check out whether those websites are NOW patched. 3) Change your password there ASAP. 4) Keep an eye out for potential phishing scams using stolen security certificates. THE FUTURE Hopefully we'll see forced revocation of security certificates via certificate authorities against all websites that have been affected by the Heartbleed bug. That move would save we Internet users a lot of grief.</div>

Security flaws Heartbleed Bug Week Two: Affected Website Testing and 'The Other Shoe'

-- [UPDATED 2014-04-18 ~11:30 AM ET. AgileBits has created a lovely Heartbleed testing page I recommend. It offers advice as well as resul...

Pak Info Zone

Pages

Time

Heartbleed Bug Week Two: Affected Website Testing and 'The Other Shoe'

Denies Hacker Removed Mark Zuckerberg’s Cover Photo

Kickstarter Stealing User Data

Popular Posts

Contact

Archive