1. Click here to join our community discord server.

PSA: Heartbleed SSL Bug (Severe)

Discussion in 'General Discussion' started by Adward, Apr 9, 2014.

  1. Adward

    Adward Game Server Moderator Staff Member

    Most of you guys have probably heard about this one - a bug in OpenSSL, the cypher system that powers about 60% of the web's secure traffic has been released and is being openly exploited against vulnerable targets.

    The worst bit is, no one knows whether or not a service has been compromised or not, and the attacks can often leave no trace in server logs. You can check a sites security level here:

    https://www.ssllabs.com/ssltest/

    I'm just going to leave a PSA here to change your most valued passwords (email/banking/paypal/etc) for sites, and to keep an eye on unusual activity.
     
    Adward, Apr 9, 2014
    #1
  2. Stefeman

    Stefeman Head Administrator Staff Member

    We're aware of it, and were running FreeBSD anyway :P

    It does not concern us.

    Thanks for reporting though.
     
    Stefeman, Apr 9, 2014
    #2
  3. Adward

    Adward Game Server Moderator Staff Member

    Not gonna lie, looked up MG in the tool myself. :P

    Just decided to aim this thread at users who have logins on other sites. :)
     
    Adward, Apr 9, 2014
    #3
  4. fnord

    fnord Game Server Moderator Staff Member

    In case anyone is worried, the bug has to be fixed on the server side, meaning you do not have to do anything personally (unless you run a site with openssl ;) ) Also, while this is a huge bug, there would have to be a MITM attack in order for your PC/data to be compromised. The only thing avg joe can do is change their password for any site that uses openssl if you want to be on the safe side.
     
    fnord, Apr 9, 2014
    #4
  5. Kitties

    Kitties Head Administrator

    Not true, clients can be vulnerable too. Focus has mainly been on how this affects servers because essentially anyone with an internet connection can connect to a public server running http+ssl/tls. However, the affected functions, tls1_process_heartbeat() and dtls1_process_heartbeat(), are used by both clients and servers, so clients are potentially just as vulnerable as servers. A Proof of Concept for an attack by a server on a client can be found here: https://github.com/Lekensteyn/pacemaker

    I quote from the above link:
    So what does this mean for the average user?

    If you run the following operating systems:

    OSX/OSX Server + iOS: No need to worry, OSX/OSX Server ships with OpenSSL 0.9.8y, before heartbeat was implemented. Additionally, OpenSSL has never been a part of iOS. You're immune. However, if you manually installed a newer library of OpenSSL as a dependency for other programs (like I did lol), then you're gonna want to patch ASAP.

    Windows: You probably won't have to worry (Windows uses SChannel/SSPI) unless individual applications of yours involve TLS through OpenSSL (cygwin, etc...), in which case you will want to patch that ASAP.

    Unix-based: You're probably vulnerable. These distros have shipped with a potentially vulnerable OpenSSL version, and will probably need patching:

    • Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
    • Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
    • CentOS 6.5, OpenSSL 1.0.1e-15
    • Fedora 18, OpenSSL 1.0.1e-4
    • OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
    • FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
    • NetBSD 5.0.2 (OpenSSL 1.0.1e)
    • OpenSUSE 12.2 (OpenSSL 1.0.1c)
    If you're running these, you're probably fine unless you've installed the vulnerable package independently, in which case you'll need to patch:

    • Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
    • SUSE Linux Enterprise Server
    • FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013
    • FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013
    • FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

    If you run the following software:

    Mozilla products/Chrome: All use NSS, so probably unaffected.

    Anything else that uses TLS, I would check to see what libraries it's using. Better safe than sorry.

    Besides all of this, you may want to change your passwords on websites such as Facebook, Gmail, etc... and you will DEFINITELY want to change your password if you use Yahoo, as that site was still vulnerable for at least 8 hours after the disclosure of the attack, and was leaking email/password combinations in plaintext: [​IMG]

    The scariest thing about this is we have no idea how long this bug has been exploited for. It's been present for approximately 2 years now, and it was only discovered by two teams who independently discovered and decided to responsibly disclose two weeks ago. Someone could have easily found it, said "Oh that's cool", and never told a soul. Combine that with the fact that it's impossible to retroactively discover if anyone exploited your server in that way (leaves no abnormal log entries), and this whole thing turns into a sysadmin's nightmare.

    However, I digress. The point is that while this bug doesn't affect the end user to the extent that it affects servers, you can easily still be vulnerable as an end user, so it's worth investigating to see if you're running anything at all that would possibly use OpenSSL.

    Stay Safe,

    -Kitties
     
    Kitties, Apr 10, 2014
    #5
  6. erik

    erik MG Donor

    fuck this shit
     
    erik, Apr 13, 2014
    #6
  7. lukemurawski

    lukemurawski Senior Member

    Awesome description, kitties! Also long time no see
     
    lukemurawski, Apr 14, 2014
    #7
  8. marvel

    marvel Head Administrator Staff Member

    Nice post indeed Kitties.

    To follow up on that, make sure you always use 2-factor authentication if you're using web mail. Google supports it and I'm sure other mail providers like Yahoo and Hotmail do so as well. 2-factor means you need a password + another authentication method to get in your email box, like a security token or sms code.

    I've already seen too many examples of hijacked steam accounts, hacked mail accounts etc. so don't be lazy.
     
    marvel, Apr 14, 2014
    #8
  9. Stefeman

    Stefeman Head Administrator Staff Member

    I second the 2-factor authentication..

    It's really pain in the ass sometimes to wait 3-7 seconds for the SMS, but it's totally worth it in the end..

    even if someone gets your password, they can't get into any of your google services (gmail, youtube, wallet, etc), without your phone too.

    Same with steam accounts.. enable the guardian asap
     
    Stefeman, Apr 14, 2014
    #9
  10. Adward

    Adward Game Server Moderator Staff Member

    My steam account has a CS:GO inventory worth around
     
    Adward, Apr 14, 2014
    #10