Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Heartbleed Used To Bypass 2-Factor Authentication, Hijack User Sessions

timothy posted about 4 months ago | from the bleeding-from-the-ears dept.

Security 59

wiredmikey (1824622) writes "Security nightmares sparked by the Heartbleed OpenSSL vulnerability continue. According to Mandiant, now a unit of FireEye, an attacker was able to leverage the Heartbleed vulnerability against the VPN appliance of a customer and hijack multiple active user sessions. The attack bypassed both the organization's multifactor authentication and the VPN client software used to validate that systems connecting to the VPN were owned by the organization and running specific security software.

"Specifically, the attacker repeatedly sent malformed heartbeat requests to the HTTPS web server running on the VPN device, which was compiled with a vulnerable version of OpenSSL, to obtain active session tokens for currently authenticated users," Mandiant's Christopher Glyer explained. "With an active session token, the attacker successfully hijacked multiple active user sessions and convinced the VPN concentrator that he/she was legitimately authenticated."

After connecting to the VPN, the attacker attempted to move laterally and escalate his/her privileges within the victim organization, Mandiant said."

cancel ×

59 comments

Sorry! There are no comments related to the filter you selected.

NSA is so annoyed right now (0)

Noah Haders (3621429) | about 4 months ago | (#46795243)

that one of their favorite exploits got outed. Was this an intentional vulnerability, like RSA?

Re:NSA is so annoyed right now (1)

Severus Snape (2376318) | about 4 months ago | (#46795271)

We all love a bit of conspiracy but it was not intentionally malicious. Simple mistake by some professor.

Re:NSA is so annoyed right now (1)

BitcoinBenny (3025373) | about 4 months ago | (#46795281)

This doesn't negate the fact that this was their favorite vulnerability. Realistically most intelligence services probably new about this shortly after that commit.

Re:NSA is so annoyed right now (3, Insightful)

Severus Snape (2376318) | about 4 months ago | (#46795299)

This doesn't negate the fact that this was their favorite vulnerability. Realistically most intelligence services probably new about this shortly after that commit.

How so was it their "favorite vulnerability"? Is there even a shread of evidence linking them with it? Exploits exist in code - we found a big bad one - great. Many white hats will have looked at the code and not noticed the flaw. That doesn't mean the NSA were using it. I'm not for a moment saying the NSA wouldn't use a similar exploit but there's nothing special about Heartbleed.

Re:NSA is so annoyed right now (1)

houghi (78078) | about 4 months ago | (#46796015)

And even if they were, it does not mean it was their favorite. Perhaps there is something out there that they like even more. Talking about code, not 'social engeneering'.

Re:NSA is so annoyed right now (0)

Anonymous Coward | about 4 months ago | (#46797817)

Did you really believe it when you were told you were the favorite child?

Re:NSA is so annoyed right now (1)

WinstonWolfIT (1550079) | about 4 months ago | (#46797979)

new? shread?

Re:NSA is so annoyed right now (0)

Anonymous Coward | about 4 months ago | (#46810167)

Yep, did Eddy Snowden's powerpoints not contain slides boasting of the NSA's ability to break VPN?

Re:NSA is so annoyed right now (1)

the eric conspiracy (20178) | about 4 months ago | (#46795343)

I don't thing NSA knew about it. Somebody would have caught the unusual requests.

Re:NSA is so annoyed right now (3, Insightful)

BitcoinBenny (3025373) | about 4 months ago | (#46795579)

I don't think so. This is a high value vulnerability, you keep it in the back pocket. Especially since it has demonstrated key extrication and affects a large number of hardware and software platforms.

Re:NSA is so annoyed right now (2)

asdf7890 (1518587) | about 4 months ago | (#46796123)

Somebody would have caught the unusual requests.

Not if they were careful about it. Someone with access to credit cards details in mind would get it discovered pretty quickly as they would be poking everywhere as quickly as they could in order to try get information so they could get as much out of the flaw as quickly as they could. This is more likely to be seen as there would be unusual amounts of traffic. But a security agency trying to find a VPN's private key? Where the VPN isn't employing FPS techniques the time you have to perform the attack it pretty long so they could easily have managed some useful penetration with much more subtle traffic, that would just look like background noise. OK so they wouldn't get something nearly as quickly that way, but a good security service plays the long game instead of looking for quick wins. Heck, even a burst of traffic would be written off by many as a random DoS attempt or some fool with a misconfigured client, so someone could have used this maliciously in bulk a few times without raising significant suspicions that would lead people to dig in and find the flaw they were trying to exploit..

This doesn't mean that the NSA did, or that they even knew about the flaw, but it means if they did know about it they certainly could have (and most probably would have) made good use of it without anyone suspecting.

Re:NSA is so annoyed right now (1)

the eric conspiracy (20178) | about 4 months ago | (#46801939)

Lots of people keep server logs around for a long time. Now that the requests that cough up private keys have been identified I would think that hack attempts would have been identified by now, just like the ones that are the subject of this story.

They haven't been.

Re:NSA is so annoyed right now (1)

AHuxley (892839) | about 4 months ago | (#46797593)

Re Somebody would have caught the unusual requests.
If a gov wants to sit between you and your site, the logs of your site would reflect whatever the gov wants.
They have man in the middle, fake sites and efforts like TURBINE would show very little skilled, attentive admins.
http://www.dailytech.com/Tax+a... [dailytech.com]

Re:NSA is so annoyed right now (1)

amiga3D (567632) | about 4 months ago | (#46796281)

I always thought Windows OS was their favorite vulnerability?

Re:NSA is so annoyed right now (-1)

Anonymous Coward | about 4 months ago | (#46795463)

Doesn't address the problem that OpenSSL is OPEN SOURCE, and this vulnerability existed for TWO YEARS, What are people doing? just blindly running their binaries? Can we please send these simpletons back to Windows Ville?

Re:NSA is so annoyed right now (0)

Anonymous Coward | about 4 months ago | (#46795497)

Since you didn't find it either, will you be leading the exodus back to M$ and Windowsville?

Re:NSA is so annoyed right now (0)

Anonymous Coward | about 4 months ago | (#46795687)

I already am on Windows you insensitive clod!

The clods are so annoyed right now (0)

Anonymous Coward | about 4 months ago | (#46796125)

I already am on Windows you insensitive clod!

Searching... [google.com] About 1,250,000 results.

The best option would obviously be a beowulf cluster of Natalie Portmans eating some hot grits, you insensitive clod! I only use trackpads, you insensitive clod! I'm self-employed, you insensitive clod! It is summer here, you insensitive clod! I don't have a car, you insensitive clod! I'm Amish, you insensitive clod! I'm self-unemployed, you insensitive clod! I have no SuperDrive, you insensitive clod! I live on zero dimensions, you insensitive clod! I'm a nudist, you insensitive clod! It's Heineken, you insensitive clod! I don't use local storage, you insensitive clod! :I am on my Windows machine you insensitive clod! I'm English you insensitive clod! I don't need more job competition, you insensitive clod! I am a phd candidate working in an university lab, you insensitive clod! I live in Australia, you insensitive clod! People are continuous, you insensitive clod! A pre-emptive 'you insensitive clod' comment. :I use Dvorak, you insensitive clod! one way to look at a thing, and it's "MY" way you insensitive clod! Bots need to catch up on their favorite shows too, you insensitive clod! I' m a third grader, you insensitive clod! I have never said 'you insensitive clod!' in a post that I remember... I'm in marketing, you insensitive clod! Brine is delicious, you insensitive clod! hey, I still work as a government contractor, you insensitive clod! I don't watch TV you, insensitive clod! Neither I have a TV, you insensitive clod! Neither I use english grammar you, insensitive clod! Engrish is not my language, you, insensitive, clod! That's Japan you insensitive CLOD! I don't think the Mongolians would appreciate you calling them 'aliens', you insensitive clod! I USE IE, YOU INSENSITIVE CLOD!! listens to Zulu chants on a purple Zune all day long and snorts without a whistle when I 'laugh', you insensitive clod! I'm still on 28.8kbps dial-up you insensitive clod! bla bla bla 300bps you insensitive clod! I can't afford to go on vacation, you insensitive clod! In Soviet Sicily, the story confirms YOU, you insensitive CLOD! I can do that without cocaine, you insensitive clod! Hey, I love feta you insensitive clod! I'm from Poland, you insensitive clod! Senior citizens can date too you insensitive clod! I dont eat corn you insensitive clod! I don't have a "you insensitive clod!" button, you insensitive clod! I'm a bald physicist, you insensitive clod! I eat two donuts at a time, you insensitive clod! I am cloud-intensive, you insensitive clod! I'm a homophobic straight male, you insensitive clod! :I use a Mac you insensitive clod! No car, you insensitive clod! Some users will also refer to seemingly innocent remarks by correcting them and adding "you insensitive clod!" to the statement... But I take my shit in the mornings, you insensitive clod!

Re:NSA is so annoyed right now (3, Interesting)

Anonymous Coward | about 4 months ago | (#46795649)

On Windows, there are probably three billion apps each with their own copy of openssl.dll, many of which will never be updated. I remember when some serious zlib bug was announced years ago, I found about 30 copies of zlib.dll on my Windows machine, all of which had to be independently replaced with a patched version.

Re:NSA is so annoyed right now (0)

Anonymous Coward | about 4 months ago | (#46796327)

Good point, I believe they can patch it here http://slproweb.com/download/Win32OpenSSL_Light-1_0_1g.exe [slproweb.com]

They would need to copy libeay32.dll ssleay32.dll and libssl.dll and overwrite all copies on their system, not just in the windows\system folder

Re:NSA is so annoyed right now (2, Interesting)

Anonymous Coward | about 4 months ago | (#46795477)

That guy RS is not a professor, but has a PhD in applied informatics.

We here in Germany no longer believe it was unintentional though, because the particular department where he works at T-Systems (the IT daughter of Deutsche Telekom), also did the remote maintenance for DLR, the German Aerospace Center, that coincidentally reported [washingtonpost.com] it's been hacked.

not enough evidence against conspiracy theory (3, Interesting)

SethJohnson (112166) | about 4 months ago | (#46795553)

I'm not convinced this wasn't an intentional effort to backdoor OpenSSL.

Code was submitted on new year's eve. A moment when the fewest people would be available to review it. Many people are on vacation and likely to gloss over the pile of code submitted while they were gone.

Just because he's a professor doesn't mean he wasn't compromised. A common page out of spycraft textbook would be to get an agent to seduce the professor and then document his infidelity. With this hanging over his head, he'll plant the requested vulnerability and even after it's discovered, he'll stick to the cover story to prevent those photos from being sent to his wife. For further reading on this topic, see the wikipedia page on Julian Assange.

Re:not enough evidence against conspiracy theory (0)

Anonymous Coward | about 4 months ago | (#46797511)

It's easier just to pay them. "Heres 10k. Do this thing. Or we destroy your life."

Re:not enough evidence against conspiracy theory (0)

Anonymous Coward | about 4 months ago | (#46797881)

Code was submitted on new year's eve. A moment when the fewest people would be available to review it. Many people are on vacation and likely to gloss over the pile of code submitted while they were gone.

One of us clearly has the wrong image of security concious developers. I want to believe that a developer for an important security related project would put any existing deadline on hold until the code was properly reviewed. That it wouldn't matter how large the backlog was.

Considering that the bug existed, it is possible that I am the one who was mistaken, not you...

A common page out of spycraft textbook would be to get an agent to seduce the professor and then document his infidelity.

It's easier to find people with bad debts, or with family members that have bad debts, and offer to pay them. If you manage to convince the person that you are on their side in some way then they will not only help you, but they will also believe in your cause enough to protect you from others. If you threaten them then you may have control over them for the moment, but you still know that they will turn against you whenever you stop watching.

If you are able to turn one professor, you could also start to turn other professors more easily (inside information regarding debts etc). That way, you get long-term assets which can help other parts of your organization (if you are willing to risk spreading info about their cooperation).

Re:NSA is so annoyed right now (2, Interesting)

Anonymous Coward | about 4 months ago | (#46795633)

Didn't the problem come about by OpenSSL doing it's own memory handling because some people's OS had slow memory management? Sounds like an excuse to have mistakes that bypass other kinds of checks.

Re:NSA is so annoyed right now (0)

Anonymous Coward | about 4 months ago | (#46795523)

http://it.slashdot.org/story/14/04/10/2235225/heartbleed-coder-bug-in-openssl-was-an-honest-mistake?sdsrc=popbyskid

Re:NSA is so annoyed right now (-1)

Anonymous Coward | about 4 months ago | (#46795831)

How many of you laugh at your co-worker that rails incessantly about the NSA, while storing his "confidential" documents on a shared xp machine.
The problem with security is there is very little difference between being a little stupid, and galactically stupid.
On another note, "Those that sacrifice security for free software deserve neither".
I put that in quotes because i am quoting myself. Make sure you credit A.C. when you use this line. All open source software is endorsed by the NSA. It's just easier.
Linux is a joke.

Is it just me, or is this just insane? (1)

mmell (832646) | about 4 months ago | (#46795313)

...researchers independently retrieved the private keys from the intentionally-vulnerable NGINX server...

Intentionally vulnerable - so this wasn't a bug in the NGINX server, it was a feature, right?

Re:Is it just me, or is this just insane? (1)

qha (23486) | about 4 months ago | (#46795367)

"intentionally-vulnerable" in your quote referrs to the intentions of Cloudflare in installing Nginx on top of a vulnerable Openssl installation.

I missed that. (1)

mmell (832646) | about 4 months ago | (#46795457)

So they were merely confirming how bad bad could get by proving that technology that relies on OpenSSL is vulnerable. Okay, thanks. I suppose there are a lot of people who might try denying that - I've already heard people muttering that the firms which are vulnerable to this exploit should have a workaround in place. This demonstration could well serve as an example of just how difficult that could be, as well as how wide-reaching the problem is.

Re:I missed that. (0)

Anonymous Coward | about 4 months ago | (#46797117)

Hopefully you don't work in tech, or a field that requires basic reading skills.

Why not? (1)

mmell (832646) | about 4 months ago | (#46797231)

Please be specific. Try to express yourself with more than a thinly veiled one-line ad hominem statement. Written exposition demonstrating linguistic and reasoning skills appropriate to an adult would also be desirable.

Re:Is it just me, or is this just insane? (3, Informative)

EvilSS (557649) | about 4 months ago | (#46795635)

...researchers independently retrieved the private keys from the intentionally-vulnerable NGINX server...

Intentionally vulnerable - so this wasn't a bug in the NGINX server, it was a feature, right?

They put up a publicly accessible NGINX server with the vulnerable version of OpenSSL to see if anyone could get the private keys from it (they thought that this was not possible from their internal testing). It only took a few hours before they were proven wrong. At the time they had already patched the rest of their systems to address the Heartbleed vulnerability.

Okay, but WHEN (1)

XanC (644172) | about 4 months ago | (#46795339)

Was this before the public disclosure, or after?

Re:Okay, but WHEN (0)

Anonymous Coward | about 4 months ago | (#46795357)

Too busy to click the linked articles?

Re:Okay, but WHEN (1)

XanC (644172) | about 4 months ago | (#46795373)

No. The linked article doesn't say. I did click on a link to the company's blog from the linked article and found it. Such critical information should have been both in the page that /. linked to and in the /. summary!

tl;dr: This took place AFTER the public disclosure, but not by much: it seems it was April 8th.

News: Not just webservers use OpenSSL! (5, Insightful)

Nanoda (591299) | about 4 months ago | (#46795359)

News: Not just webservers use OpenSSL!

No kidding. My Synology NAS had a same-day update to patch this - my custom router firmware needed updating too. If there's a story for every device someone forgot might contain OpenSSL code, it's going to be a busy month.

Re:News: Not just webservers use OpenSSL! (3, Informative)

Gaygirlie (1657131) | about 4 months ago | (#46795547)

Speaking of routers, DD-WRT is vulnerable, but only if you use its VPN-service. It doesn't use OpenSSL for anything else, and if the VPN-service isn't enabled then there's not even that.

Re:News: Not just webservers use OpenSSL! (1)

hax4bux (209237) | about 4 months ago | (#46795799)

Thanks for that info. I haven't had time to look.

Re:News: Not just webservers use OpenSSL! (2)

Demonantis (1340557) | about 4 months ago | (#46795845)

Thank you. This is good to know. I used, https://filippo.io/Heartbleed/ [filippo.io] , to test my web facing services. No affiliation. I found it through Google.

Re:News: Not just webservers use OpenSSL! (2)

asdf7890 (1518587) | about 4 months ago | (#46796167)

The key thing to note is that the main vulnerability here is through the use of OpenVPN with an affected SSL library. IIRC OpenVPN is only affected when used in "pre shared key" mode instead of using client certificates (which is the recommended way of running things anyway), so there is further mitigation there (but anyone using OpenVPN needs to check they config and confirm that the server end (if using another party for that) has done so too.

There are other parts of DD-WRT that could potentially be a problem too (tor particularly as it runs a listening service) if you have them turned on. See their own advisory for more details: http://www.dd-wrt.com/site/con... [dd-wrt.com] .

Re:News: Not just webservers use OpenSSL! (1)

Anonymous Coward | about 4 months ago | (#46796017)

News: Not just webservers use OpenSSL!

Yup.

Although, this article is about a device that uses https on port 443 to set up a vpn, so I would still call it a webserver.

Common non-webservers would be SMTP servers that use OpenSSL for STARTTLS, along with POP and IMAP servers.

Re:News: Not just webservers use OpenSSL! (1)

colfer (619105) | about 4 months ago | (#46796331)

Yes, LiteSpeed web server, a common drop-in replacement for Apache, had the bug even when the shell of a LAMP stack did not. LS patched it.

If this bug had been in 0.9.8 the web would be in a real disaster now. Many web ISP's stay behind a few versions on the stack. I've got one that runs the oldest PHP version still in release. That's a bit extreme. So the bug hit more big companies.

Re:News: Not just webservers use OpenSSL! (1)

colfer (619105) | about 4 months ago | (#46796335)

In other words, you could not detect the bug by looking at "openssl version" at the shell prompt, or looking for the openssl version in phpinfo().

Modern security model horribly broken. (1)

Anonymous Coward | about 4 months ago | (#46795379)

It seems completely obvious to me that each authenticated session to any remote server should be running as a separate user. There is something so fundamentally wrong about any security model where it is possible for the code executing for one user to access data private to another user.

Re:Modern security model horribly broken. (1)

flyingfsck (986395) | about 4 months ago | (#46795475)

SELinux or Apparmor will prevent that, but it is usually not installed on embedded systems.

Re:Modern security model horribly broken. (0)

Anonymous Coward | about 4 months ago | (#46795509)

It sounds like the attacker used HeartBleed to gain access to an authenticated user's account and then tried to escalate their stolen users account privileges after that.

Re:Modern security model horribly broken. (0)

ledow (319597) | about 4 months ago | (#46795537)

It doesn't matter how clever you are... at some point, some session will have to run with more privileges than the user in order to be able to do something.

Or, as here, the session gets taken over as "just a user" and steals all their data / credentials anyway and tries to move deeper by finding more.

The problem of privilege separation can be fixed today, the tools are there. The problems described here aren't helped or hindered by privilege separation.

To be honest, what you have to have is an enormously fine-grained permission system no matter what, and that - in itself - is a recipe for disaster. Eventually you get to the point where you need to deploy tools to find out what permissions are given as certain users because it gets so complex.

Or you could just patch when a problem is noted, especially when it involves your SSL library.

SSL - TLS (0)

Anonymous Coward | about 4 months ago | (#46795453)

This is why a competent VPN will run ipsec and not some silly little ssl - tls implementation that allows a session token that can be copied.

Schneier's 11 was well-justified (5, Interesting)

SuperKendall (25149) | about 4 months ago | (#46795809)

Lots of people scoffed at Bruce Schneier for saying Heartbleed is an 11 on the 1-10 scale... I agree that sometimes he goes overboard but this is not one of those times, and the attack mentioned in the article demonstrates this.

The summary is a little muddled on what happened here, but if you follow the link you'll find this is not a security test or a research group showing something could theoretically be done. This is a real live company somewhere just using a VPN many other companies probably use, that had over the course of many hours multiple VPN session hijacked and made use of. That is a huge deal, if one person can do this you can almost bet there is a script somewhere that even the great unwashed hacker masses can make use of.

More than just heartbleed here (0)

Anonymous Coward | about 4 months ago | (#46795933)

Session token as an authenticator isn't multifactor. If I can resume your VPN session from a different IP than you established the link then it sounds like time to rethink how you are doing session management.

Re:More than just heartbleed here (1)

asdf7890 (1518587) | about 4 months ago | (#46796209)

While it won't happen in the vast majority of cases, so you could implement a client address lock as an option, there are a number of valid reasons why a session might jump from one address to another.

cos3k (-1)

Anonymous Coward | about 4 months ago | (#46795997)

we aal kno3,

thanks a lot you open source bozos... (0)

Anonymous Coward | about 4 months ago | (#46796519)

many eyes, my ass.

Mitigation (2)

duke_cheetah2003 (862933) | about 4 months ago | (#46796777)

Just as a side note, for any corporate intranet with VPN and web servers facing the outside world, it really is a good idea to isolate your various services, so if one is compromised, the others aren't. This is a classic example of why you should do that: If the web server and VPN were on separate VM's, heartbleed fishing through the web server wouldn't have exposed the VPNs keys.

I wish I could afford to practice that myself, I unfortunately lump all my internet facing services on one VM, but for a corporation with more assets, it really is a cheap way to cover your butt.

Re:Mitigation (0)

Anonymous Coward | about 4 months ago | (#46797847)

" This is a classic example of why you should do that:"

No it isn't. This was a SSL VPN device. The VPN device itself was the web service and the target. VMs would do absolutely nothing to address this and only lead to worse performance.

The biggest security vulnerability is assumption and a lack of attention to detail. This is why security is hard.

Lesson 1 (1)

viperidaenz (2515578) | about 4 months ago | (#46797681)

Your application server shouldn't be running SSL.

I can't think of one good reason to expose your application server to the internet.

Has the bug been fixed or not (1)

Stan92057 (737634) | about 4 months ago | (#46798093)

Has the bug been fixed or not? Or is this a case of poor security management by not applying the fix??

Not obvious enough? (0)

Anonymous Coward | about 4 months ago | (#46806431)

OpenBSD supplied 250 commits in a week.

Who else thinks the NSA doesn't find shit like this on a daily basis?

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>