[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20140409224753.37B42601E7@smtp.hushmail.com>
Date: Wed, 09 Apr 2014 22:47:48 +0000
From: "mancha" <mancha1@...h.com>
To: oss-security@...ts.openwall.com
Subject: Cauterizing OpenSSL's heartbleed (the aftermath)
There's an important distinction between systems "never vulnerable to
heartbleed" (for appropriate definitions of never) and those fixed in
response to security announcements. The latter category should
definitely be prioritizing revocation/reissuance of certificates and
other potentially compromised credentials.
Mustafa Al-Bassam's work assists a great deal with this taxonomy. He
ran PoC code against Alexa top 100, 1000, and 10000 sites beginning
about 18 hours after OpenSSL's first public announcement [1].
Specifically, his scans began circa: 1396956600 (top 100); 1396958400
(top 1000); and 1396972800 (top 10000). Did any major vendors deploy
upgrades prior to this?
If others have done similar work (hopefully closer to time zero), please
share to complement Mustafa's good work.
--mancha
====
[1] https://github.com/musalbas/heartbleed-masstest
-----------------
PGP: 0x25168EB24F0B22AC
[56B7 100E F4D5 811C 8FEF ADD1 2516 8EB2 4F0B 22AC]
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
