Number:IRCNE2014042160
Date: 2014-04-15
According to “computerworld”, four researchers working separately have demonstrated a server's private encryption key can be obtained using the Heartbleed bug.
The findings come shortly after a challenge created by CloudFlare, a San Francisco-based company that runs a security and redundancy service for website operators.
CloudFlare asked the security community if the flaw in the OpenSSL cryptographic library, made public last week, could be used to obtain the private key used to create an encrypted channel between users and websites, known as SSL/TLS (Secure Sockets Layer/Transport Security Layer).
The private key is part of a security certificate that verifies a client computer isn't connecting with a fake website purporting to be a legitimate one. Browsers indicate a secure connection with a padlock and show a warning if the certificate is invalid.
Security experts thought it might be possible that the private key could be divulged by exploiting the Heartbleed flaw, which may have affected two-thirds of the Internet and set off a mad scramble to apply a patch that fixes it.
"This result reminds us not to underestimate the power of the crowd and emphasizes the danger posed by this vulnerability," wrote Nick Sullivan of CloudFlare on the company's blog.
By obtaining the private key for an SSL/TLS certificate, an attacker could set up a fake website that passes the security verification. They could also decrypt traffic passing between a client and a server, known as a man-in-the-middle attack.
Researchers are still trying to figure out the conditions under which what specific data is revealed. OpenSSL, an open source program, is used in a wide variety of operating systems, mobile applications, routers and other networking equipment.
How the researchers each accomplished obtaining the private key hasn't been revealed.
- 5