EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

04.18.14

Some Perspective on Heartbleed®

Posted in GNU/Linux, Microsoft, Security at 8:12 am by Dr. Roy Schestowitz

Looking through the tube

Summary: Our views on the whole Heartbleed® bonanza, which seems like partly a PR stunt (for multiple stakeholders)

A LOT has been said about Heartbleed® since the firm of Microsoft's 'former' security chief (who had worked with the FBI, the NSA’s more evil twin) irresponsibly 'leaked' the flaw, and did so at the very same moment that Windows XP users rushed to GNU/Linux for security reasons. I know of such users (even corporations I deal with) and I saw their reaction to this unforeseen ‘leak’. Funny timing.

In this post we outline some key facts (carefully and patiently studied over the past 10 days). As my doctoral degree is not far from cryptography and I have consulted people who do security for a living, I can assure readers that we do grasp the technical details, unlike many so-called ‘journalists’ with degrees in English or history. We are not going to delve into less plausible theories like a connection between the flaw and the NSA although there are circumstantial connections, an NSA program specifically designated to this (NSA operation ORCHESTRA), and we already know that Red Hat relays non-SELinux code directly from the NSA to Torvalds, as we covered earlier this year (meaning that only a developer in the middle knows where the code originally came from). In this particular post we are going to focus on other important points that ought to be made now that Heartbleed® is mostly out of the headlines and little new information will come out during Easter. This post is based on assessment of about 100 reports and subsequent research lasting many hours.

A little and slightly old tidbit shared with us by iophk (a network security professional) said that even the NSA and its circles are negatively affected by Heartbleed®. This article states: “”I am waiting for a patch,” said Jeff Moss, a security adviser to the U.S. Department of Homeland Security and founder of the Def Con hacking conference.”

There are reasons to believe that the NSA was not aware of this flaw or had not exploited it. For instance, the government’s demands from Lavabit may suggest that OpenSSL back doors were not known at that time (2013). Also, reading all about the personal background of the man behind the bug, it’s nearly impossible to find any connection to the NSA and its ilk. The guy is German, but another German Danish developer (Poul-Henning Kamp, a FreeBSD and Varnish developer) spoke only some months ago about a US program of introducing bugs into FOSS (see “NSA operation ORCHESTRA” above).

iophk responds to the article about firewalls woes by asking: “Why the hell is he not running one based on Linux or BSD? Something’s not right. Proprietary “solutions” have no place in infrastructure for just these kinds of reasons.”

Well, with Windows, for example, the NSA perhaps assumes a monopoly on back doors. It’s a form of total control.

The BSD community, which is also behind OpenSSH, has begun doing some commendable things [1,2] short of throwing away OpenSSL [3]. There is a new release of GnuTLS [4], for example, but we cannot be 100% certain that GnuTLS is immune to “bug doors”, as Julian Assange recently called them. “GnuTLS was immune to the OpenSSL bug,” writes iophk, “but in regards to the latter was ‘responsible disclosure’ followed? I got the feeling that it wasn’t and that the web site was set up and publicized before even the OpenSSL team was informed. Where can I find a detailed timeline of events?”

Well, a deceiving timeline was later published by the Australian press. Security gurus have widely chastised this form of ‘responsible’ disclosure of Heartbleed®; even the project site of OpenSSL hadn’t been patched before the disclosure. The same goes for the FBI, which again helps validate claims that the government was not fully aware of the issue.

OpenSSL was having limited resources and some articles covered it [5-7]. Regardless, it’s now claimed NSA knew about the bug for 2 years and we should always remember that Microsoft’s Howard Schmidt was connected to FBI before his firm published Heartbleed® for fame, fun, and profit. It’s not just Microsoft that makes his motives a tad suspicious. The whole Heartbleed® thing “has a very media friendly name and a cute logo,” as a British FOSS professional put it. It’s like a branding exercise. Also see this post titled “What Heartbleed Can Teach The OSS Community About Marketing”. “Ties in a bit with what you’ve posted,” iophk told me after I had noted the marketing angle.

As a recap, Heartbleed® was pretty much branded and released like a product by a firm headed by a Microsoft (and FBI) veteran. This firm also works with Microsoft, so the disclosure on Windows XP’s EOL date is too hard to ignore, If this was already known about by the NSA for years, then one may wonder if the disclosure came through whispers rather than research. Glyn Moody was told by Wikileaks (Twitter account seemingly run only by Julian Assange) that “Assange spoke about vulnerability of OS’s to bribes and bugdoors in upstream components.”

Howard Schmidt (chairman of board of company that marketed Heartbleed®) worked with the FBI and another NSA partner/PRISM pioneer (Microsoft). If the NSA knew about the bug, then one wonders what role Schmidt may have played. The last thing that the NSA wants is people (especially outside the US) adopting Free software and GNU/Linux because Microsoft is where back doors are; by design, not by accident. Heartbleed® was reportedly known to the NSA for years (every article that claims this cites Bloomberg, which is notable corporate press and usually a bit dubious when it comes to agenda). If true, this was the type of bug that Edward Snowden’s leaks had alluded to (bug doors, not back doors). Schmidt et al. might be trying to exploit it for FUD and profit, by opportunistically divulging it as soon as mass migration to GNU/Linux in enterprises and homes begins. A decade ago it seemed like a back door had been put inside Linux by the NSA, but the developers caught the intrusion and removed it. There were numerous reports last year saying that the NSA had approached Torvalds, asking him for back doors in Linux, so what Seggelmann did in OpenSSL should not be treated too lightly. The time of the committal is a little suspicious [8] (people away from home to celebrate New Year) and the reputation of OpenSSL is now thoroughly destroyed, which will help its competitors (including proprietary) [9]. There is now a lot of FUD out there about FOSS (the only one we’re willing to cite is [10] because it’s not too malicious), sometimes coming from the mouths of Microsoft boosters or challenging Torvalds’ famous “law” [11,12]. I even get taunted over this in Twitter. The old FUD is back, never mind Coverity’s latest report which again contradicts such FUD.

Mind the article “Heartbleed security flaw may not be as dangerous as thought” [13], which sheds some light on who’s able to exploit and who’s not able to exploit Heartbleed® given the resource limitations (the thing about crackers of the NSA and GCHQ is that they have supercomputers to have a crack at it, and the same is probably true when it comes to the FBI, which is in many ways worse and more aggressive than the NSA; the FBI infiltrates Windows with CIPAV). If the widely-cited reports are true and the NSA knew Heartbleed® (and used it for two years) [14-17], then it’s a massive revelation (the NSA denies this, but denials from the NSA are worthless given its track record when it comes to truth-telling).

Perhaps the most disturbing thing about the story is, the NSA may have discovered Heartbleed® years ago (if not made it, which sounds unlikely [18]) and the firm of Microsoft’s ‘former’ security chief is making a profit from this [19] (the Heartbleed® bounty is partly paid by Microsoft and the partly Microsoft-owned Facebook). A bunch of opportunists got paid for irresponsible disclosure that damaged the Internet [20,21] and harmed many people’s privacy (potentially leading to some people’s deaths).

The GNU/Linux brand is profoundly damaged by this (many GNU/Linux sites mentioned it [22-24]) even though the bug also affects Windows and Apple operating systems. To us it will always seem like marketing campaign coordinated to take place at a strategic date (Windows XP EOL).

Has Microsoft’s Howard Schmidt decided to ‘leak’ it to distract from XP EOL (which means insecurity by policy)? Perhaps. Schmidt had worked with the FBI, so he could have some inside knowledge. He might have former colleagues who could tell him about this (even leak it to him) before he would hype it up, give it a scary name, make a dot com web site, a logo, et cetera, essentially ‘merchandising’ the FUD.

Related/contextual items from the news:

  1. OpenBSD Team Cleaning Up OpenSSL
  2. OpenBSD has started a massive strip-down and cleanup of OpenSSL
  3. Please Put OpenSSL Out of Its Misery
  4. GNUtls: GnuTLS 3.3.0
  5. How to stop the next Heartbleed bug: pay open-source coders to protect us
  6. Will Open-Source Money Prevent the Next Heartbleed?
  7. 3 big lessons to learn from Heartbleed

    The devastating OpenSSL vulnerability proves the importance of data center orchestration, the wisdom of running older versions, and the need to give back to the OpenSSL project

  8. Heartbleed: developer who introduced the error regrets ‘oversight’

    Submitted just seconds before new year in 2012, the bug ‘slipped through’ – but discovery ‘validates’ open source

  9. After Heartbleed: 4 OpenSSL alternatives that work
  10. Heartbleed: Open source’s worst hour”>Heartbleed: Open source’s worst hour
  11. Does the Heartbleed bug refute Linus’s Law?

    The mistake being made here is a classic example of Frederic Bastiat’s “things seen versus things unseen”. Critics of Linus’s Law overweight the bug they can see and underweight the high probability that equivalently positioned closed-source security flaws they can’t see are actually far worse, just so far undiscovered.

  12. Heartbleed: Is Linus Torvald’s law invalid?

    How much data was compromised? How many billions lost? None that we know of. How much does the world loses every year because of Microsoft’s proprietary technologies? Billions of dollars are lost; nations’ securities are compromised and people lives are exposed to risks.

    A majority of NSA attacks won’t be possible without bugs in Microsoft products which the company reportedly shares with the agency so that it can be exploited to hack into computers that NSA can spy on. Microsoft bugs allowed USA to take down nuclear programs of countries like Iran, Microsoft bugs enabled NSA to spy on French president. Microsoft bugs allowed ‘alleged’ Chinese crackers to run a massive scale espionage against human rights activists in the US. In addition there are unaccounted thousands of cases every year where people and businesses lose millions due to security holes in Microsoft products.

  13. Heartbleed security flaw may not be as dangerous as thought

    But today, the content distribution network CloudFlare has announced Heartbleed may not allow access to those private keys after all. In two weeks of testing, the company has been unable to successfully access private keys with Heartbleed, suggesting the attack may not be possible at all. “If it is possible, it is at a minimum very hard,” researcher Nick Sullivan writes. “And we have reason to believe… that it may in fact be impossible.” If true, it makes Heartbleed much less dangerous than many had feared, offering a saving grace for compromised sites. Sullivan acknowledged that, in security tests, some private keys had been revealed by first requests to Apache servers, but he linked this to the process of restarting the server, which would severely limit the exposure to outside actors. Methods have also surfaced to help services tell if attackers have hit their servers using the bug. “Heartbleed still is extremely dangerous,” says CEO Matthew Prince, “but some of the worst fears about it having been used by organizations like the NSA to hoover up everyone’s private SSL keys look pretty unlikely to us based on this testing.”

  14. NSA has been exploiting Heartbleed for two years, leaving Americans exposed to cyber criminals: report [updated]

    As people were wondering NSA’s role in Heartbleed, it turned out that the agency was reportedly aware of the bug, as Bloomberg reports, for the last two years and has been exploiting it to spy on people. If the reports are true and NSA was aware of the bug and instead of getting it fixed it let extremely critical info of US citizens exposed to cyber criminals then NSA does need more oversight from the government.

    Heartbleed was not some minor bug, it affected almost every major web-service including Gmail, Amazon, Yahoo! and many more – holding the potential of exposing sensitive data to criminals. However, as soon as the bug was discovered the Open Source community immediately responded, patched the bug and start pushing the updates.

    While the Americans and the people from around the globe were exposed to cybercriminals, NSA was supposedly busy harvesting passwords and other critical to add it to already massive database.

    Bloomberg quotes Jason Healey, director of the cyber statecraft initiative at the Atlantic Council and a former Air Force cyber officer, “It flies in the face of the agency’s comments that defense comes first. They are going to be completely shredded by the computer security community for this.”

  15. NSA Said to Exploit Heartbleed Bug for Intelligence for Years
  16. Bloomberg: NSA Knew About, Exploited Open Source Heartbleed Bug for Years
  17. The NSA has exploited Heartbleed bug for years, Bloomberg reports
  18. Heartbleed coder admits ‘oversight’ but backs open source

    Seggelmann submitted the code at 11:59pm on New Year’s Eve 2011, but claims the timing had nothing to do with the mistake. Although the bug was also missed by the review process for OpenSSL, an open source project written and reviewed by volunteers, Seggelmann told British newspaper The Guardian that the bug’s eventual discovery shows the value of publically available open source code.

  19. Why a hacker got paid for finding the Heartbleed bug

    Microsoft and Facebook have also provided financial backing to Internet Bug Bounty, out of which Mehta’s prize money came, after running their own internal bug bounties that were very successful. Their money is benefiting the internet as a whole, but they don’t decide what money goes where.

  20. The Internet’s Telltale Heartbleed
  21. Heartbleed developer explains OpenSSL mistake that put Web at risk
  22. SteamOS Affected by Heartbleed Bug, Valve Hasn’t Updated the OS Yet
  23. Linux Foundation Responds to the Heartbleed Bug

    It’s nearly impossible to know for sure, due to the nature of the vulnerability, how much the Heartbleed vulnerability was used to snoop on secure data. We recommend for our sites the same as for other sites: first, watch for a statement to come out from your financial institutions, email providers, and others, which shares whether they were affected. Start changing your passwords. Use different passwords on different sites and store them in a password safe like KeePass, LastPass or 1Password. That way, if any sites that remain vulnerable leak your password, it won’t affect any other sites. Check back on sites that post statements after you changed the password, and then change the passwords again if needed.

  24. Working Out “Serious Security Flaws” In DRM Drivers

    While many are still busy working through fallout of the OpenSSL Heartbleed bug within organizations, on a separate but security related note, kernel developers specializing in the Direct Rendering Manager (DRM) graphics drivers are working to beef up their own driver security.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. Needs Sunlight said,

    April 18, 2014 at 1:43 pm

    Gravatar

    There is a timeline of the events published here:

    http://www.smh.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140415-zqurk.html

What Else is New


  1. Links 24/1/2017: New Release of SMPlayer, Arch Dropping i686 Support Soon

    Links for the day



  2. US Supreme Court (SCOTUS) Keeps Introducing Changes to Patent Law and Patent Policy Under the Trump Administration Still Looks OK

    Judging by what we are seeing so far this year, the US patent system won't be going back into the sordid mess it once was, thanks in part to the Justices of the US Supreme Court and the America Invents Act, signed into law over half a decade ago



  3. Leaked: Team Battistelli, Exploiting a Controversial Decision From the Netherlands, is Trying to Squash SUEPO

    The latest leak suggests that Battistelli not only celebrates immunity from the law but also uses that to take further steps against the Staff Union of the EPO (SUEPO)



  4. Dr. Ingve Björn Stjerna: UPC's “Entry Into Force is Not at all Secured,” Contrary to What Team UPC Says

    The ludicrous notion that the UPC is inevitable and just a matter of time is challenged by longtime UPC observers, including Dr. Ingve Björn Stjerna, who wrote an entire book on the subject



  5. Media Blasts EPO Over Immunity Amid Suicides, Battistelli's Behaviour Compared to Dominique Strauss-Kahn's

    Backlash in the Netherlands is growing again, primarily as a result of media reports about the EPO's abuses against basic rights and the government's reluctance to put an end to these abuses



  6. Hilarious: Battistelli Goes to Former French Colony With No Patents to 'Buy' the EPO a Perception of Legitimacy

    Having toured various banana republics in pursuit of easy-to-sign deals, Battistelli now goes to Cambodia again, in order to make it seem as though the EPO is conquering Asia



  7. Patent Trolls Like Finjan Holdings and Thomas Edison; the Latest Loss for Software Patents in the US and Their Move to China

    A look at the very latest patent news, which suggests further improvements in the US, pushback from the patent microcosm, and an outsourcing of a terrible system to Chinese territories, where the overpatenting plague grows rapidly



  8. Still Waiting for Official Confirmation That Michelle Lee Will Head the Patent Office Under Donald Trump's Administration

    As of today, there is still no official word on whether or not Lee continues her tenure, which saw the demise of patents on software and along with that the demise of patent trolls and frivolous litigation



  9. Links 23/1/2017: Wine Releases, Microsoft Layoffs

    Links for the day



  10. 'Reform' at the EPO Means Destroying the Staff Union, Crushing Patent Examiners, and Imposing on Europe a System It Does Not Want (UPC)

    The chaotic transition at the EPO -- a transition from something which has been workable to something intolerable -- and the role of the Unitary Patent (UPC), which lurks in the shadows and threatens to harm the whole of Europe



  11. Shakeup Against Patent Parasites in the US and More Rumours/Speculations About USPTO Director Michelle Lee After Trump's Inauguration

    The US patent system is becoming ever more hostile towards patent trolls, owing in part to reforms introduced under Michelle Lee's tenure, but people are still not certain that she will maintain her job and continue to fix the system



  12. EPO Abuses Now Make the Netherlands Look Like a Facilitator of Human/Labour Rights Abuses

    Rather than crack down on human rights abuses, the Dutch government now sends out the signal that it's an island for those wish to violate human rights whilst enjoying immunity (EPO)



  13. Links 20/1/2017: Docker 1.13, Linux 4.4.44 LTS

    Links for the day



  14. “Federal Circuit Had Affirmed on Every Issue in 77.4% of the Patent Trial and Appeal Board Appeals it Had Seen” in 2016

    The Federal Circuit (CAFC) and Patent Trial and Appeal Board (PTAB) continue to squash a lot of patents on software, in contrast to that fake news from patent maximalists



  15. Kudelski Group Not Only Acts Like a Patent Troll But Also Run by Intellectual Ventures Person; Mobile Market in Dire State of Patent Armageddon

    The patent thicket which pervades everything that is used by billions of people, mobile technology in particular, can be traced back to a lot of non-practicing parasites (or patent trolls)



  16. Watchtroll and His Swamp Still Blame Google (Where Michelle Lee Came From) for Improving and Gradually Fixing Aspects of the US Patent System

    Shooting the messengers (even wrongly associating yours truly with Google) in an effort to undermine patent reform when it is so desperately needed due to serious injustices



  17. In an Age of Necessary Patent Reform and Permanent Uncertainty for Software Patents the Patent Microcosm Looks for Workarounds and Spin

    Commentary on the status quo in the Michelle Lee era and some examples of bias from the patent microcosm, as well as news regarding the NFL getting sued by the Kudelski Group



  18. Michelle Lee, USPTO Director, Should Recognise That the Patent Microcosm is Her Enemy Which Hates Her

    The latest outburst from the patent microcosm, which has a temper issue and notorious disdain for judges it does not agree with, is more of what we have come to expect



  19. Battistelli is an Autocrat Above the Law and It's OK, Holland's High Council Says

    Battistelli's autocratic tendencies will not be challenged by Dutch authorities, in spite of sheer condemnation from many groups all across Europe and the entire world



  20. Beware Fake News About the Unitary Patent (UPC)

    The UPC is dead, deadlocked, stuck, in a limbo and so on; those who claim otherwise are merely lobbying (in disguise of "analysis" or "news")



  21. Shame on MapR for Pursuing Software Patents While Pretending to Stand for Free/Open Source Software

    The patents gold rush sees another company joining the 'fun', albeit this company should campaign hard against software patents rather than pursue any



  22. Doomsday Scenario in the Back Mirror as Michelle Lee Keeps Her Job (and Much-Needed Patent Reform) at the USPTO

    The future of patent reform, i.e. tackling overpatenting and patent trolls, looks somewhat more promising with today's confirmation of Lee's 'extended tenure' at the Office



  23. Links 19/1/2017: PulseAudio 10.0, Linux 4.9 Longterm Kernel

    Links for the day



  24. Corporate (Wall Street) Media Agrees That Brexit Dooms the Unitary Patent (UPC)

    The nonstop lies or the fake news about the UPC starting "real soon now" don't quite pass a reality check or a basic assessment based on fundamental concepts, such as the UPC's facilitation of subordination (to Europe) in the United Kingdom



  25. Farce of an 'Independence' for the Boards of Appeal as Another Ally of Benoît Battistelli Enters as Parasite Inside the 'Overseer'/Host

    The latest cluster of lies from the President of the European Patent Office (EPO) and direct refutation of false claims of independence for the Boards of Appeal, where the former Vice-Presidents can flock, just like the Mini Minion (Minnoye) of Battistelli



  26. Links 18/1/2017: Red Hat's OpenShift 3.4, Mozilla's New Logo/Branding

    Links for the day



  27. Union-Busting Action by Team Battistelli Takes Heavy Toll, Techrights Will Continue to Expose EPO Injustices to the World

    The Staff Union of the European Patent Office, SUEPO, which faced unprecedented and probably illegal (based on local laws) attacks, is being weakened by the worst President ever, whose own management team seems to be collapsing along with the institution he is destroying in just a few years



  28. A Lot More Fake News About the UPC, Trying to Convince People That the UK is Ratifying (It's Not, It Cannot)

    Response to some of the latest misleading (self-serving) whispers about the fate of the Unified Patent Court (UPC), which is in a deadlock due to Brexit



  29. Rumours Suggest That EPO Management is Aware of Decline in Patent Quality and is Thus Actively Lying About it to the Media/Public

    Whenever Battistelli brags about patent quality he may be consciously and deliberately lying through his teeth if the latest rumours are correct



  30. Links 17/1/2017: GIMP Plans, New Raspberry Pi Product

    Links for the day


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts