heartbleed explained

30

Upload: abshek-surya

Post on 20-Feb-2017

83 views

Category:

Software


0 download

TRANSCRIPT

Page 1: Heartbleed Explained
Page 2: Heartbleed Explained

2008 - 2011

Page 3: Heartbleed Explained
Page 4: Heartbleed Explained
Page 5: Heartbleed Explained
Page 6: Heartbleed Explained
Page 7: Heartbleed Explained
Page 8: Heartbleed Explained
Page 9: Heartbleed Explained
Page 10: Heartbleed Explained
Page 11: Heartbleed Explained
Page 12: Heartbleed Explained
Page 13: Heartbleed Explained
Page 14: Heartbleed Explained
Page 15: Heartbleed Explained

Anything < < 64kb

Page 16: Heartbleed Explained

1 kilobyte of data

1 kilobyte of data

64 kilobytes of data

64 kilobytes of data

Page 17: Heartbleed Explained

1 kb

SIZE = 64kb

Page 18: Heartbleed Explained

1kb

Hey server, it’s 64kb

64kb

1kbRequested data - + 63kb - Memory padding

Page 19: Heartbleed Explained

63 kb

1 kb

95AS4D4DFG5FD5S5SD4 ADS5F4SDF55SDGF4SG5DFGH4DF6DSZX5GRF4GHTRH4TYJY5Y4RR6W6Q54WRW6ER54PERWE6R5XE4RWE6R54Y

USERNAME = TESTPASSWORD = 1234SECURITY QUESTIONSCONFIDENTIAL FILESPRIVATE INFORMATIONOTHER SECRET STUFF

Page 20: Heartbleed Explained

1kb

Hey server, it’s 64kb

64kb

Page 21: Heartbleed Explained

Issue is withOpen SSL

Page 22: Heartbleed Explained

Open SSLImplements SSL <<

Page 23: Heartbleed Explained

So the SSL protocol itself is fine.It’s just an implementation flaw

Page 24: Heartbleed Explained
Page 25: Heartbleed Explained
Page 26: Heartbleed Explained

But, don’t worry.It has been patched and updated now.

Although no one knowswhat information has been leaked

or who exploited it.

Page 27: Heartbleed Explained

Now, for the final touch…

Page 28: Heartbleed Explained
Page 29: Heartbleed Explained

Yes, you may ask yourdoubts now.

Page 30: Heartbleed Explained

Special thanks to this guy