Editing 1354: Heartbleed Explanation
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 12: | Line 12: | ||
A [[Megan]]-like character named Margaret (or "Meg") sends heartbeat requests to the server, the server responds to the heartbeat request by returning the contents of the body of the request up to the number of letters requested. The first two requests are well formed, requesting exactly the number of characters in the request body. The server's memory is showing Meg's request with many other requests going on at the same time. | A [[Megan]]-like character named Margaret (or "Meg") sends heartbeat requests to the server, the server responds to the heartbeat request by returning the contents of the body of the request up to the number of letters requested. The first two requests are well formed, requesting exactly the number of characters in the request body. The server's memory is showing Meg's request with many other requests going on at the same time. | ||
| − | Meg then ponders this and tries to | + | Meg then ponders this and tries to another request asking for "HAT" but requests that it be 500 letters long instead of only 3; the server —not checking it or simply unaware that 500 letters is larger than the request body— returns "HAT" plus 497 letters that happened to be next to the word "HAT" in its memory (more will follow than are shown in the server's speak bubble as there are only 251 letters/symbols in the shown reply). Included are many sensitive bits of information, including a master key and user passwords. One of the passwords shown is "CoHoBaSt", a reference to [[936: Password Strength]], which suggests using "<u>co</u>rrect <u>ho</u>rse <u>ba</u>ttery <u>st</u>aple" as a password. |
| − | Often popular explanations of security bugs require the issue to be simplified a lot and to leave out a lot of details. In this case [[Randall]] didn't have to do much simplifying; the bug is actually that simple. Also, any client | + | Often popular explanations of security bugs require the issue to be simplified a lot and to leave out a lot of details. In this case [[Randall]] didn't have to do much simplifying; the bug is actually that simple. Also, it should be noted that any client which can connect to the server typically can exploit this bug in the underlying {{w|OpenSSL}} software — the use of the term "User Meg" does not imply that Meg had to authenticate first. |
Although Randall shows Meg recording the data by hand, on paper, it is more likely that a person exploiting the bug would have a computer record the data, perhaps on its hard drive or on a flash drive. However one could argue that such a person would not communicate to the server by speaking out loud either. | Although Randall shows Meg recording the data by hand, on paper, it is more likely that a person exploiting the bug would have a computer record the data, perhaps on its hard drive or on a flash drive. However one could argue that such a person would not communicate to the server by speaking out loud either. | ||
