bk99.de entertain the web since 1997

bk99.de
CCC · TLS securityCurated

Heartbleed and its aftermath

Summary

Zakir Durumeric examines Heartbleed with internet-wide measurements and shows its spread, key risks, speed of response and the vulnerable systems that remained. Small memory bugs can trigger global infrastructure crises through widely used libraries. An effective response needs inventory, patching, key changes and transparent communication together.

Ideas

  • A missing length check let remote clients read other processes’ memory.
  • Memory contents could include credentials, sessions and possibly private keys.
  • An update alone was not enough if keys and certificates had already been exposed.
  • Internet-wide scans made the progress of remediation measurable.

Recommendations

  • Record centrally which services use cryptographic libraries.
  • Plan key and certificate changes as a normal part of incident response.

References

Watch the talk

Search the Web Archive

CCC · 2023

Operation Triangulation: Five vulnerabilities to iPhone surveillance

oct0xor, kucher1n and bzvr_ reconstruct a multi-stage iOS zero-click chain that combined four zero-days and an undocumented hardware feature. The chain used five vulnerabilities, four of them zero-days. The analysis led to fixes for four previously unknown vulnerabilities.

CCC · 2022

Linux security monitoring with audit events

Hilko Bengen shows how Linux auditd delivers fine-grained host events and how the unwieldy format can be made usable for attack detection with reasonable effort. Network monitoring only detects many attacks together with context from the affected host. More telemetry only helps if events are reliably correlated and prioritised.

CCC · 2021

Two-factor authentication for your own SSH server

Florian Winkler shows how SSH can be extended with a second factor via PAM and which configuration steps effectively secure your own Linux server. More factors only increase security if recovery and bypasses are designed just as carefully. A factor stored separately makes the theft of a single file less valuable.