When I first heard it, I suspected that there was something more behind it. Thing is - as secret services are not able to actually brute-force encryption, they needed to find a way around. And the only one way around was to either use existing bugs/weaknesses, or implant some (as NIST).
http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html Don't you guys feel that in the last 12 months, there are very many bugs related to SSL showing up ? IMHO that is not a coincidence... these are too many for me to believe this is coincidence. I really believe that some secret service agencies have made sure that certain weaknesses are implanted or if discovered, remain where they are (in the dark) so they can actually use these if required. The best about that is the media coverage. I have rarely (except when I hear politicians talk) heard so much junk in so short sentences. On Tuesday 08 April 2014 03:10:06 Kirils Solovjovs wrote: > We are doomed. > > Description: http://www.openssl.org/news/vulnerabilities.html > Article dedicated to the bug: http://heartbleed.com/ > Tool to check if TLS heartbeat extension is supported: > http://possible.lv/tools/hb/ > > A missing bounds check in the handling of the TLS heartbeat extension > can be used to reveal up to 64kB of memory to a connected client or server. > > 1.0.1[ abcdef] affected. -- You can no more win a war than you can win an earthquake. -- Jeannette Rankin ------------------------------------------------------------------------ Joerg Mertin in Clermont/France Web: http://www.solsys.org PGP: Public Key Server - Get "0x159DC660F946126F" _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
