[READ] [2/3 of PASSWORDS EXPOSED] All internet passwords exposed.

Apr 9, 2014 07:43 AM

Change your passwords for everything.

So as some of you may know, a few hours ago a bug in SSL was made public. This bug is called heartbleed, and affected 2/3 of the internet by exploiting memory leaks to give the hacker usernames, passwords and content. As I am a nice person, I just wanted to warn users about this, and I strongly urge everyone reading this to change thier password for everything, as I am doing now.

There probably are other threads about this, but all users may not still be aware.

Read up on this more:
http://www.theepochtimes.com/n3/609175-h...s-at-risk/

http://heartbleed.com/

http://www.theguardian.com/technology/20...of-servers

http://www.bbc.co.uk/news/technology-26935905

http://lifehacker.com/what-the-heartblee...1560801201

Apr 9, 2014 07:45 AM

Uh.
There has been no proof of a hacker exploiting this in the wild.
If you have 2FA you shouldn't be bothered by this either.

Rem · Apr 9, 2014 07:45 AM

I read about this just a little while ago, and I was surprised. However, I was too lazy to change passwords, lol.

Apr 9, 2014 07:47 AM

(Apr 9, 2014 07:45 AM)xhflhkeuhwguu34 Wrote: Uh.
There has been no proof of a hacker exploiting this in the wild.
If you have 2FA you shouldn't be bothered by this either.

No, but read the second link and you will see that people could hack themselves.

~Jay~ · Apr 9, 2014 07:47 AM

It isn't necessarily true that two thirds of all passwords have been leaked, just that two thirds of servers used the vulnerable software. There's no guarantee that the servers were vulnerable, or even the vulnerable ones you used were hacked, or that your password was in the memory dump when it was hacked. They don't even know if heartbleed was widely used or not.

Apr 9, 2014 07:51 AM

(Apr 9, 2014 07:47 AM)~Jay~ Wrote: It isn't necessarily true that two thirds of all passwords have been leaked, just that two thirds of servers used the vulnerable software. There's no guarantee that the servers were vulnerable, or even the vulnerable ones you used were hacked, or that your password was in the memory dump when it was hacked. They don't even know if heartbleed was widely used or not.

This bug had been known for 2 years, and a few hours ago many, many people were made aware of it. Of course there is no guarantee (as the bug leaves no trace), but there is a huge chance.

Apr 9, 2014 07:54 AM

(Apr 9, 2014 07:51 AM)thehen101 Wrote: This bug had been known for 2 years, and a few hours ago many, many people were made aware of it. Of course there is no guarantee (as the bug leaves no trace), but there is a huge chance.

It has not been known for two years.
It may have been in the code for two years but certainly not known.

Tony S · (This post was last modified: Apr 9, 2014 08:01 AM by Tony S.)

No.

First of all, I think 2/3 of websites/services on the Internet being vulnerable is an extremely far-fetched and stupid guesstimation especially given that there is no evidence to back this claim up. A large portion of the top 1000 Alexa-ranked sites didn't even use SSL whatsoever, and most of the ones that did fixed the bug within no time.

Even IF two thirds of every service that used OpenSSL is (or was) vulnerable at one point, it doesn't mean that all of their base were stolen. Large corporations such as Cloudflare and Google along with software distributors were pre-notified of the vulnerability so that they could prepare fixed and patches for release on disclosure day, meaning a lot of services that were vulnerable fixed it straight away, and the large majority of other websites/services that were vulnerable managed to fix it in no time whatsoever since they have dedicated teams that look at stuff like this.

With that being said, there were still a vast amount of websites/services that had been exploited maliciously and this happening had been brought to the attention of the public in a swift manner, two of the more notable ones being PlentyOfFish and Yahoo!.

Furthermore, using the bug you're only able to grab 64kb chunks of memory from the target at one time. You're not going to get Yahoos entire userbases' data with a bug like this. There is the off chance that if it were something like a forum, a privileged user could have had their credentials/sessions stolen and attackers could have used that to leverage their own privileges.

However, I think that if a large company which millions of people use knows that they are affected by this, they will be smart enough to take the proper precautions needed to ensure that the integrity of their users isn't going to be violated. Whether this be resetting password for everyone that logged in during a specific time, resetting users sessions or just notifying them that their data might have been compromised.

Apr 9, 2014 09:24 AM

I change all my passwords every month or two, so I guess I'll do it early this April. Good heads up, OP.

Ap‌‌ · Apr 9, 2014 09:32 AM

Heartbleed only allow's the attacker to grab 64K of memory. Sure it can be ran over and over again but it would take a GREAT amount of time to do this to multiple websites on the web. I posted an example of the heartbleed exploit dump.

Spoiler (Click to View)

Apr 9, 2014 09:47 AM

(Apr 9, 2014 09:32 AM)Ap‌‌ Wrote: Heartbleed only allow's the attacker to grab 64K of memory. Sure it can be ran over and over again but it would take a GREAT amount of time to do this to multiple websites on the web. I posted an example of the heartbleed exploit dump.

Spoiler (Click to View)

Yeah, that shows that it is possible. This has been in circulation fo a while, and even though the chance that many people affected is small, there's still a chance. If a group of people were to concentrate on one server for a while, sooner or later they would strike gold and reveal sensitive information.

Aura · Apr 9, 2014 09:50 AM

OKAY STOP POSTING NEW THREADS ABOUT THIS EVERY HOUR.
We already have 3-4 threads dedicated to this, USE THEM.

Apr 9, 2014 09:52 AM

(Apr 9, 2014 09:50 AM)Aura Wrote: OKAY STOP POSTING NEW THREADS ABOUT THIS EVERY HOUR.
We already have 3-4 threads dedicated to this, USE THEM.

you should make a thread telling people to stop making threads about it

Apr 9, 2014 09:56 AM

(Apr 9, 2014 09:52 AM)xhflhkeuhwguu34 Wrote: you should make a thread telling people to stop making threads about it

I originally posted this in the lounge, I'm actually quite glad there are threads about this because it shows that people on HF still have a small amount of 'care for the community'.

Some websites are still vulnerable:
http://filippo.io/Heartbleed/#avazutracking.net

Aura · Apr 9, 2014 09:56 AM

(Apr 9, 2014 09:52 AM)xhflhkeuhwguu34 Wrote: you should make a thread telling people to stop making threads about it

I'm about to do it. Just take all the fucking threads and put them in one.

Login
Username/Email:
Password:	Lost Password?
	Remember me