[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Heartbleed (was ... Re: My fellow (Debian) Linux users ...)

On 2014-04-14, Richard Hector <richard@walnut.gen.nz> wrote:
> This one, on the other hand, was generally not predicted, and was widely
> exploited before people got a chance to fix it. That's presumably still
> going on.

Widely exploited?


Possible exploitation prior to disclosure 

 Many major web sites patched or disabled the bug within days of 
 its announcement,[30] but it is unclear whether potential attackers were aware of 
 it earlier and to what extent it was exploited. Based on examinations of audit logs 
 by researchers, it has been reported that some attackers may have exploited the 
 flaw for at least five months before discovery and announcement.[31][32] Errata 
 Security has partially rejected this hypothesis,[33] whereas the Department of 
 Homeland Security believes that as of April 11, "there have not been any reported 
 attacks or malicious incidents involving this particular vulnerability confirmed".

Reply to: