The reason grandparents and grandchildren get along so well is that they have a common enemy.— Sam Levenson
- The Illusive Man on Photo Phriday – Mountains
- Dalien, aka 13 HANDS on Photo Phriday – Mountains
- The Illusive Man on Words of Wisdom
- stuart walker on Words of Wisdom
- The Illusive Man on Photo Phriday – Mountains
- josh on Photo Phriday – Mountains
- The Illusive Man on Passport-out
- CherryPie on Passport-out
- The Illusive Man on Passport-out
- CherryPie on Passport-out
You may have heard quite a bit in the news recently about a security issue with something called OpenSSL: the exploit has been rather dramatically referred to as Heartbleed.
So what is OpenSSL, and what is “Heartbleed”, exactly?
OpenSSL is an open source – that is freely downloadable – security suite for providing security and encryption across network links, mainly to secure websites on the internet. It does this by using the SSL (Secure Sockets Layer) and TLS (Transport Layer Security) to encrypt data between a client and a server, ensuring that traffic cannot be intercepted or read by a snooper. Its useful to keep your banking details and logon credentials secure.
Heartbleed is an exploit that has become known due to a change in the TLS protocol, and it affects all versions of OpenSSL from the release of 1.0.1 to 1.0.1f. This change was first discussed in RFC 6520. This introduced the concept of “heartbeats” into the TLS protocol. For those who don’t know, a “heartbeat” is kind of data packet exchanged across a network link between a client and a server to ensure the connection remains open as long as necessary. The data packet contains a header describing what it is, and some “padding” data which is returned by the server to the client in order to show that it has been correctly received and understood.
The RFC describing the change limits the size of the heartbeat packet to 16KB, but generally OpenSSL generates far shorter packets using the following code:
unsigned int payload = 18; /* Sequence number + random bytes */ unsigned int padding = 16; /* Use minimum padding */ /* Check if padding is too long, payload and padding * must not exceed 2^14 - 3 = 16381 bytes in total. */ OPENSSL_assert(payload + padding <= 16381); /* Create HeartBeat message, we just use a sequence number * as payload to distuingish different messages and add * some random stuff. * - Message Type, 1 byte * - Payload Length, 2 bytes (unsigned int) * - Payload, the sequence number (2 bytes uint) * - Payload, random bytes (16 bytes uint) * - Padding */ buf = OPENSSL_malloc(1 + 2 + payload + padding); p = buf; /* Message Type */ *p++ = TLS1_HB_REQUEST; /* Payload length (18 bytes here) */ s2n(payload, p); /* Sequence number */ s2n(s->tlsext_hb_seq, p); /* 16 random bytes */ RAND_pseudo_bytes(p, 16); p += 16; /* Random padding */ RAND_pseudo_bytes(p, padding); ret = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
Don’t worry if you don’t understand C…
The reason the code says that the payload and padding must not exceed 16381 bytes in total is because the 16KB (16384 byte) packet includes one byte to signal that the transmission is a TLS1_HB_REQUEST and two bytes to denote the length of the payload in the request. This means that the line OPENSSL_assert(payload + padding <= 16381); is redundant because the payload size is hard-wired to 18 bytes and the padding to 16 bytes. The programmer has tried to do the right thing, though, by including this check, just in case someone changes the payload or padding sizes in the future without consideration for any possible consequences.
The code then transmits the heartbeat request, which when completed consists of:
- A single byte 0×01 denoting that this is a TLS1_HB_REQUEST packet
- Two bytes containing the 32-bit representation of 34 (the size of the payload and the padding)
- Two bytes of payload consisting of a 16bit sequence number
- 16 bytes of further random data to make up the remainder of the 18 byte payload
- 16 bytes of further random padding data required by the standard
Unfortunately, when the server replies to a heartbeat, the programmers weren’t so careful about how it handles and validates its data. As noted above, heartbeat replies are meant to include a copy of the payload data in order to confirm that both ends of the connection are open and that the two machines can understand each other. Well, it turns out that you can sneakily send a small payload packet in your heartbeat request, but set your payload size field to 0xFFFF (65535 bytes), and the server will return this much information!
/* Allocate memory for the response, size is 1 byte * message type, plus 2 bytes payload length, plus * payload, plus padding */ buffer = OPENSSL_malloc(1 + 2 + payload + padding); bp = buffer; /* Enter response type, length and copy payload */ *bp++ = TLS1_HB_RESPONSE; s2n(payload, bp); memcpy(bp, pl, payload); bp += payload; /* Random padding */ RAND_pseudo_bytes(bp, padding); r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
This means that OpenSSL runs off the end of your payload packet and scoops up whatever else might be next in memory space and returns that as part of the packet. This data could potentially include user names, passwords, other message contents or even private keys!
The new version of OpenSSL includes a check on the server’s side to validate the length of the received data before replying, meaning the memory “bleed” effect no longer happens. Administrators whose servers run on an affected version of OpenSSL are strongly advised to upgrade to the latest release to remove the potential effects of this bug. If you can’t upgrade for any reason, recompiling the source code of your current version using the -DOPENSSL_NO_HEARTBEATS switch is strongly advised: this option does not include the heartbeat code in the compiled programs, meaning the feature with the exploit is not available.
So as a user, do you need to worry? Well, potentially.
There is always a risk, however small, that someone could have been maliciously using this vulnerability in order to hoover up potentially sensitive information that should never have been exposed. The risks might be tiny (after all, with all the millions of users accessing various servers on the internet, what are the chances that your account details were compromised?) but its better to be safe than sorry.
If you’re concerned about your account security, Mashable has been keeping a list of services running compromised versions of OpenSSL. If you suspect that your account may have been accessed improperly before you have been able to change your password, you should contact the help and support/administration staff of the website in question.
I’ve not long gotten back from my hols, and I’m still sorting through photos and videos, and deciding what should go in the “official” record of events, as well as recovering from something has given me something akin to radiation burns on my shins (though nowhere else…) so there’s nothing ready for that yet.
While you wait, dear readers, why not enjoy some samples of some up-coming movies? After all, this year does look like its offering us a bumper crop of blockbusters!
First up, everyone loves a good superhero movies, and no one does superheroes quite like Marvel, so here’s the taster for Captain America: The Winter Soldier
Next, and sticking with the superhero theme, we have X-Men: Days of Future Past.
Thirdly, we come to a universal fact: giant robots are cool. Transformers are giant robots, and in this outing they come with dinosaurs. Dinosaurs are cool, and giant robot dinosaurs are even cooler, which means this movie, Transformers: Age of Extinction is looking very promising indeed.
I’m not normally a fan of anything religious. That’s a topic for another time, but I have to say that this adaptation of the Biblical story of Noah is looking very, very good…
Finally, everyone enjoys a good monster movie. The original movie monster, Godzilla, is due another outing after the failures that have appeared over the last couple of decades, and this looks like the outing he really needs to cement his place in modern movie history.
Political Correctness (noun) – A doctrine fostered by a delusional, illogical minority, and rapidly promoted by a mainstream media, which holds forth the proposition that it is entirely possible to pick up a piece of shit by the clean end.
I had to go to Liverpool today. It was my own fault, I suppose.
My passport expired in February. I had known of the pending expiration for some time - at least as far back as October and my trip to Vegas, but I did nothing about it. Still, a first class return ticket from Stafford was only £48, and the weather wasn’t too bad, so I took a train ride.
Breakfast on the train was good: coffee, orange juice, porridge with honey, toast and a croissant. The lady who served me was lovely, too. The trip took about an hour, and thanks to my Wheel of Time audio books, it slipped by in quick order.
I planned to get a taxi from Lime Street to the passport office, however it turned out that my ticket gave me access to the Liverpool underground at no extra cost, so I used that instead: according to the lady on the information desk, I could use the Wirral Line to go to James Street, and the office was just around the corner. On getting to James Street, however, I was told that the advice I had been given at Lime Street was not quite right, and I should continue on for another station, then take the Old Hall exit, and the building was on the right. Turned out this was right, and I quickly found myself walking to the passport office.
My appointment wasn’t until 11:30, and it was around 11:00 when I got there and cleared security. A quick visit to the facilities was followed by a 5 minute wait before I was called to a booth with a very attractive young lady who quickly checked my paperwork, wrote out a receipt and said my documents would be ready at 15:00. So, after paying, I left the building, got some lunch at a nearby Costa and then took a walk down to the docks and the museums.
The Maritime museum has some excellent exhibits, and entry is free, though I would encourage you to make a donation. There were plenty of tourists and school outings around the docks, which made it pretty crowded, but even so, I found it quite relaxing. There were also a number of memorials to members of the Merchant Navy who sailed and defended the Atlantic Convoys between America and Liverpool during World War 2, which were very sobering, and are worth a moment or two of contemplation, if you find yourself near them.
Near to these, there were padlocks attached to a chain-link fence, with words and messages inscribed or written on them. Some had rusted and the messages eroded, but some were still readable, and rather touching: it really is the small things that help to keep the darkness at bay at times.
I returned to the passport office around 14:40, a little earlier than my scheduled collection time, but I figured I could wait there, if I had to. The security guard remembered me from before, and let me through after a cursory check of my bag. I had to wait a couple of minutes to be seen at the desk, as there was only one attendant working, but I was quickly given my new passport, and was on my way again. As I walked down the office toward the exit, I noticed the nice girl who cleared my application earlier was still working at her desk, so a smile and a wave were in order.
It took only a few minutes to get back to Lime Street using the underground service, and a there was a short wait for the train back to Stafford. Again, I couldn’t fault the service on the train. A nice rare beef and mustard sandwich, coffee, cake, peanuts and pretzels and a couple of beers: all train journeys should be like that!
I was back home just after 17:00, with very achy legs: far more exercise today than I usually get!
Welcome to the new Radio Nowhere!
Parts of the site are still being moved over, developed and updated, so please bear with me while all the changes are made. The site and its content is now kindly hosted by 1&1 – if you’re after a hosting solution, do give them a look, they’re responsive, reasonable and reliable; all you can ask for in a web host really!
Due to the excessive amounts of spam being directed at the contact form, I have taken it offline for the time being. If anyone has any comments they would like to share, or would like to get in touch about something, please feel free to leave a comment here or on the post you’re asking about. Apologies for the inconvenience.
Enjoy this sneak preview of one of the scenes from the up-coming instalment of The Hobbit: The Desolation of Smaug which sees Bilbo helping his Dwarven companions out of yet another sticky situation…
This wonderful cover of Rambling Man by The Routers…
Let it always be known that I was who I am….