|
| 2 people marked this as a favorite. |
Is paizo.com affected by the Heartbleed bug?
If so, can you fill us in on what we need to know?
| 2 people marked this as a favorite. |
Given the site is hosted on Apache, odds are good. What you need to know is that evidently a well-designed attack from the outside could read arbitrary data in memory on the web server. The most obvious use of that would be to capture Paizo's private key for their SSL certificate. That could enable a man-in-the-middle attack, but such a thing would in turn require a DNS hijacking, which isn't trivial. Unless such a thing happens, that's not an earth-shattering problem. The second possible exploit would be to capture personal information as it's entered, such as say... credit card info while you're entering it. If Paizo has designed things well, the stored credit card information will be on a separate server designed to do the actual transactions, meaning that unless you're updating/changing CC info you should be safe.
I don't expect Paizo to say much about this. Revealing anything about your internal server structure is... unwise. But the bottom line is that the risk to you is probably minimal. A lot of the problem with OpenSSL is what could be done. It's unclear what site(s) are poorly designed enough that the flaw actually matters for them.
As far as I know, OpenSSL has already been patched, in which case Gary and the gang may have already updated their server cluster. I'm just trying to give you a generic answer that applies here, and elsewhere, until a more specific one is available.
| 2 people marked this as a favorite. |
We can change our passwords, but if we do NOT confirm this issue is resolved, changing to a new password is worthless.
So... someone from Paizo, we really need a Blog entry on this issue, and pretty damned pronto saying Heartbleed either does not apply or HAS BEEN fixed and Paizo strongly suggests everyone change their passwords.
I can just imagine Paizo is busy with things, and short staffed, and so on. But the credibility and cash of Paizo depends on a secure store. I would *not* want to be the company that ... well, one word... just one:
Target
| 2 people marked this as a favorite. |
http://filippo.io/Heartbleed/
Suggests Paizo is clear.
We can change our passwords, but if we do NOT confirm this issue is resolved, changing to a new password is worthless.
..and this is why I have not changed one password
|
http://filippo.io/Heartbleed/
Suggests Paizo is clear.
It is entirely possible that Paizo is either not running openSSL or is running a version that was not affected by this bug (openSSL 0.9.8 and earlier were not affected, I think ... not that it made a difference to my servers, <shakes fist>).
Either way, a notice of "We were not affected" or "We have patched the hole and reissued our SSL Certs, please reset your passwords." would be nice to see.
EDIT: of course, if they were vulnerable, they could still be working on making sure everything is secured. The last 28 hours or so has been one of major suckage dealing with this issue and all the related, cascading adjustments that need to be made.
Assistant Software Developer
|
| 13 people marked this as a favorite. |
Given the site is hosted on Apache, odds are good.
Actually, due to our specific hardware and software setup, we're not affected by HeartBleed, thank goodness. We've double checked everything and made sure none of our systems had any problems with HeartBleed and everything seems to be vulnerability free. We're one of the lucky ones it seems.
|
Assistant Software Developer
|
Yeah, System Admins globally have had a hard couple of days or are going to have a REALLY hard couple of days in the future I think. Luckily most big companies are on the ball with their updates.
That said, I like a policy where people change their passwords every so often and keep different passwords for different purposes at the very least and I know I will be changing a bunch of passwords this weekend regardless. =)
|
|
Yep ... I got the patch in place and dealt with the SSL Certs yesterday (we were secure within 24 hours of the initial announcement on Monday) ... Going through today and trying to finish up changing passwords to our wordpress installs, to the FTP accounts, databases, the works.
All in all a world of suck on top of the regular workload that still needs to be completed on time. The kicker is we just went through and updated all our passwords about 2 months ago ...
| 9 people marked this as a favorite. |
okay so now that I am done changing everything for my clients and informing that no I did not cause this and no I could not have predicted it and that no they are safe and that no terrorists are not going to haxor them and that no every major site they are involved with has updated properly I think I going to go throw up for awhile because being screamed at for two days straight is tough on my tummy
Yeah, System Admins globally have had a hard couple of days or are going to have a REALLY hard couple of days in the future I think. Luckily most big companies are on the ball with their updates.
That said, I like a policy where people change their passwords every so often and keep different passwords for different purposes at the very least and I know I will be changing a bunch of passwords this weekend regardless. =)
Unfortunately, you can't rely on changing your password until you've gotten a confirmation that a patch has been applied _and_ they've rotated their keys as it's possible to pull the private key from the server :(
This is going to be a very bad next little while for sysadmins. I feel for you guys!
|
Assistant Software Developer
|
Unfortunately, you can't rely on changing your password until you've gotten a confirmation that a patch has been applied _and_ they've rotated their keys as it's possible to pull the private key from the server :(
This is going to be a very bad next little while for sysadmins. I feel for you guys!
Well, I know I've already gotten some confirmations and such and I'm sure other people have as well. I expect a few more by this weekend. Also, while my bank wasn't affected, I'll be changing my password there anyway, cause it's been awhile and I need to do it anyway.
|
Mashable has a list of sites that were affected and have been patched.
There are some heavy hitters there. It looks like most financial institutions don't use OpenSSL, fortunately.
| 3 people marked this as a favorite. |
Heartbleed sounds like the name of a spell.
"Okay, I'm going to move 30 ft as a move action and cast Heartbleed on the enemy cleric as my standard. Now he has to make a DC 20 Fort save each round or take 1d4+1 Con damage".
I think the most relevant issue is who put this in. NSA seems a prime suspect.
| 1 person marked this as a favorite. |
Yeah, System Admins globally have had a hard couple of days or are going to have a REALLY hard couple of days in the future I think. Luckily most big companies are on the ball with their updates.
That said, I like a policy where people change their passwords every so often and keep different passwords for different purposes at the very least and I know I will be changing a bunch of passwords this weekend regardless. =)
Good advice there. A few more points:
1. Some big companies are safe because they don't update all the time. I'll qualify that - the version 1.0.0 is not vulnerable, but still supported. Unless the functionality offered by 1.0.1 is really wanted, a big company has no real impetus to update "just because". That's why bleeding edge is called that - you might get cut!
2. It's open source so it's easy to work out who put it in. The big question is did they know they were putting it in, or was it just a coding error? It sat there in plain sight for 2 years and wasn't fixed - that implies it was hard to spot. Although I admit that government agencies use the Hide In Plain Sight strategy all the time (yay Pathfinder ref!)
3. There maybe a bit of an overreaction to this, due to media hype:
"The odds of getting a key using this technique are incredibly low to begin with, let alone being able to recognize you have one, and how to correlate it with any useful encrypted data.
Supposing you do hit the lottery and get a key somewhere in your packet, you now have to find the starting byte for it, which means having data to attempt to decrypt it with. However, now you get bit by the fact that you don't have any privileged information or credentials, so you have no idea where decryptable information lives.
Assuming you are even able to intercept some traffic that's encrypted, you now have to try every word-aligned 256B(?) string of data you collected from the server, and hope you can decrypt the data. The amount of storage and processing time for this is already ridiculous, since you have to manually check if the data looks "good" or not.
The odds of all of these things lining up is infinitesimal for anything worth being worried about (banks, credit cards, etc.), so the effort involved far outweighs the payoffs (you only get 1 person's information after all of that). This is especially true when compared with traditional means of collecting this data through more generic viruses and social engineering.
So, while I'll be updating my personal systems, I'm not going to jump on to the "the sky is falling" train just yet, until someone can give a good example of how this could be practically exploited."
But hey, better safe than sorry! I'm changing all my passwords in about a week. It's also given me the push to use a password manager, so I'll be scoping them out until then.
4. Just because OpenSSL is patched, doesn't mean that everyone can fix things right away - some vendors bundle OpenSSL into their products, and you can't shove in a vanilla patch without it hurting somewhere. Admins are still waiting for some vendors to release platform-specific patches.
A good debate on the topic is here. I got the above quote from there.
RPG Superstar 2014 Top 16
|
| 2 people marked this as a favorite. |
Today's XKCD has a great explanation of the bug that's really easy to understand. In case anyone reading this thread is wondering what the heck everyone is talking about :-)
| 1 person marked this as a favorite. |
We can't really point that finger at the NSA for this. The software is open source, so in principal any of us with sufficient qualifications (not me!) could have audited the code to find the bug, and yet the bug has been in the wild since December 2011.
Is this a design flaw in SSL/TLS protocol specification?
No. This is [an] implementation problem, i.e. programming mistake in popular OpenSSL library that provides cryptographic services such as SSL/TLS to the applications and services.
OpenSSL Security Advisory [07 Apr 2014]
========================================TLS heartbeat read overrun (CVE-2014-0160)
==========================================A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.
Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1.
Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for preparing the fix.
Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
1.0.2 will be fixed in 1.0.2-beta2.
@Tamago: Thanks for that XKCD link. I LOLed.
@Lissa: While https://secure.paizo.com is not vulnerable to Heartbleed, according to Qualys SSL Labs it does have some lingering security shortfalls because you're still running TLS 1.0 (which, ironically, is probably why you weren't vulnerable).
|
Assistant Software Developer
|
@Lissa: While https://secure.paizo.com is not vulnerable to Heartbleed, according to Qualys SSL Labs it does have some lingering security shortfalls because you're still running TLS 1.0 (which, ironically, is probably why you weren't vulnerable).
The two are only tangentially related, actually. Like I said, I'm really not going to go into our architecture, but we're aware of our TLS being a bit out of date and it's on my list of things that are on my plate now. =) Luckily, they aren't super worryful things but they need to be fixed soon. Nothing even close to the scope of HeartBleed thank goodness.
| 3 people marked this as a favorite. |
I'm changing mine to 12345. I got the idea from my luggage.
That should be fine as long as you don't use the same one for your air shield.
|
| 1 person marked this as a favorite. |
But hey, better safe than sorry! I'm changing all my passwords in about a week.Me too. I'm changing them all from "password" to "password2".
You weren't using Password1? What kind of sites you frequent if they don't ask of at least a majuscule and a number in the password?
:-)| 1 person marked this as a favorite. |
I just had an idea! Couldn't I use my login name as password too? Just think, I wouldn't have to remember two pieces of info for every site!
Nononono. You need to add a 1 on the end, Sissyl1.
| 1 person marked this as a favorite. |
Butbutbut... if my login ends with a 1 then?
Nah, they've gotta be different.
Sissyl... and Sissyl1. See?
But then I wouldn't gain any of the convenience of not having to remember both login and password!!!
I just had an idea! Couldn't I use my login name as password too? Just think, I wouldn't have to remember two pieces of info for every site!
Most sites prevent you from doing this.
But hey, better safe than sorry! I'm changing all my passwords in about a week.Me too. I'm changing them all from "password" to "password2".
You're changing all my passwords? But how do you know all my usernames across the web? And how did you know they all used 'password'? And how will I know if a given website has "password2" or my own new password of "Password" before I lock myself out? That would cause CHAOS!
...
This Heartbleed bug is more serious than I thought :-)
The two are only tangentially related, actually. Like I said, I'm really not going to go into our architecture, but we're aware of our TLS being a bit out of date and it's on my list of things that are on my plate now. =) Luckily, they aren't super worryful things but they need to be fixed soon. Nothing even close to the scope of HeartBleed thank goodness.@Lissa: While https://secure.paizo.com is not vulnerable to Heartbleed, according to Qualys SSL Labs it does have some lingering security shortfalls because you're still running TLS 1.0 (which, ironically, is probably why you weren't vulnerable).
I heard about an increase in Spamming, could this be related?
The two are only tangentially related, actually. Like I said, I'm really not going to go into our architecture, but we're aware of our TLS being a bit out of date and it's on my list of things that are on my plate now. =) Luckily, they aren't super worryful things but they need to be fixed soon. Nothing even close to the scope of HeartBleed thank goodness.@Lissa: While https://secure.paizo.com is not vulnerable to Heartbleed, according to Qualys SSL Labs it does have some lingering security shortfalls because you're still running TLS 1.0 (which, ironically, is probably why you weren't vulnerable).
What exactly does "assistant software developer" mean? I'm curious.
Anyways, while the TLS 1.0 attack (BEAST/CRIME) does require some finagling to exploit it is quite possible to do so and it isn't exactly hard. Although you do have to find someone gullible enough to click on a bad link. And paizo in particular persists their sessions for a long time.
BREACH is actually the super scary one... And upgrading to TLS 1.2 doesn't help. :(
|
Assistant Software Developer
|
What exactly does "assistant software developer" mean? I'm curious.
It means that I work for Gary. I believe that was Ross's title as well. Generally that means working on various parts of the site. Recently, that means attending to a stack of hardware and infrastructure issues. I haven't been a SysAdmin for some time but it was my primary job for a few years so with some shuffling around recently, I find myself in a position to do a lot more of that and quite a bit less software development.
Anyways, while the TLS 1.0 attack (BEAST/CRIME) does require some finagling to exploit it is quite possible to do so and it isn't exactly hard. Although you do have to find someone gullible enough to click on a bad link. And paizo in particular persists their sessions for a long time.
True, but I hope to get that particular bit mitigated soon. I've got two things on the back burner for that that are just waiting for some immediate emergency stuff that I need to finish before I can get it into place.
BREACH is actually the super scary one... And upgrading to TLS 1.2 doesn't help. :(
And those are just some of the ones we know about right now. We'll figure them out. There are a couple of proposed fixes on the horizon.
| 1 person marked this as a favorite. |
I'm changing mine to 12345. I got the idea from my luggage.But hey, better safe than sorry! I'm changing all my passwords in about a week.Me too. I'm changing them all from "password" to "password2".
5? You added 5 after 1234?! That's brilliant! Why I hadn't thought about that?!