“Heartbleed” – Critical Vulnerability in OpenSSL :Office of the CISO - washington.edu

Office of the CISO

“Heartbleed” – Critical Vulnerability in OpenSSL


Published: April 14, 2014
Last Update: April 14, 2014 4:00 pm


Summary

A major new web security vulnerability was disclosed by security researchers on Monday, April 7, 2014.  At the time of disclosure, the vulnerability dubbed “Heartbleed” affected a large portion of websites on the Internet that use certain versions of the OpenSSL software package to encrypt web traffic (pages that start with https).

The vulnerability could enable remote attackers to steal sensitive information such as passwords from a vulnerable server’s memory. In conjunction with the public disclosure, OpenSSL.org released updated source code to fix the vulnerability; however, updated software packages were not readily available from operating system (OS) vendors until the following day.


What UW Has Been Doing

Since the afternoon of Monday, April 7, 2014, UW-IT staff and other University IT professionals including departmental IT support staff, UW Medicine IT Services staff, and the members of the UW Office of the CISO have been working to identify and remediate servers affected by the vulnerability.

The UW Weblogin service was a major area of concern, since the servers that support it see frequent use by members of the UW community who enter UW NetIDs and passwords to authenticate to access online services. At the time the Heartbleed vulnerability was publicly disclosed, the Weblogin servers were running a vulnerable version of OpenSSL. They were all updated and restarted as soon as updated software packages were released by the operating system vendor, and are now no longer vulnerable. Other critical servers managed by UW-IT were also remediated in the same way.

What the Internet Community Is Doing

Online service providers, cloud providers, and other server administrators around the world have been assessing their systems in order to fix vulnerable versions of OpenSSL.

What You Can Do

Be on the alert: It is anticipated that phishers and other cybercriminals will try to capitalize on the broad attention this topic has gathered and will likely send out emails with links to fake Weblogin pages or other means to try to collect your password. Do not click on links in emails that direct you to change your UW NetID password. Instead, go to the UW-IT IT Connect webpage and navigate to the appropriate page if you need to change your password.

Make sure that any “client side” software you are using is up to date and fully patched. This includes software that commonly uses SSL/TLS encryption such as web browsers, email clients, instant messaging clients, productivity software,  and operating systems.

Many software companies have released updates for their products in response to Heartbleed. Printers, copiers, and other network connected devices may also use OpenSSL, and may be vulnerable. If you have questions about a specific device, contact the manufacturer.

It is important to note that not all web servers on the Internet use OpenSSL, and not all versions of OpenSSL in use are vulnerable. Many popular websites that were vulnerable at the time of disclosure installed fixes on their systems shortly thereafter. Check the FAQ section below for additional information.


Heartbleed FAQs

Did my UW NetID password get stolen?

Should I change my UW NetID password anyway?

Should I change my passwords for other non-UW websites I use?

How do I know if a website I use has been fixed, or even was vulnerable in the first place?

Which versions of OpenSSL are vulnerable?

How long has this vulnerability been around?

How widespread is this problem?


Technical Details

SSL (Secure Socket Layer) and TLS (Transport Layer Security) are cryptographic protocols designed to provide communication security over the Internet. OpenSSL is a popular open source software package that allows implementation of SSL and TLS for web servers such as Apache.

At the center of the Heartbleed vulnerability is OpenSSL’s implementation of a function called the “TLS Heartbeat extension” (RFC 6520). It provides a keep-alive function that allows a connection between a client and a server to stay open for extended periods of inactivity. When implemented correctly, the client sends a payload of arbitrary data to the server, which sends back an exact copy of that data to confirm everything is OK.

Vulnerable versions of OpenSSL 1.0.1 fail to check bounds of a “memcpy()” call, and allow unsanitized user input for the payload length parameter. A malicious attacker can trick a vulnerable version of OpenSSL by sending a request claiming to be 64K in size, which actually contains a much smaller payload size. Under those circumstances OpenSSL will fill up the discrepancy between the claimed payload and the actual payload sent by copying data from memory, which can contain sensitive information.

Under certain circumstances, a malicious attacker may be able to steal user passwords or even a web server’s private cryptographic key using this vulnerability. Once an attacker has the private key for a particular server and website, the key can be used to decrypt captured traffic previously sent to and from the server. It could also be used to facilitate “Man In The Middle” attacks if an attacker can manage to inject himself between the user and the webserver for which he managed to steal the private key.

This threat exists up until the point where the server gets updated and has the compromised private key removed. It is the main reason why server administrators should regenerate private keys for servers that were running vulnerable versions of OpenSSL.

A very detailed technical write-up can be found at “The Register.”


Events and Communications Timeline

  • Monday, April 7, 2014 at approximately 10:30am – The vulnerability was publicly disclosed by OpenSSL.org. Source code for OpenSSL version 1.0.1g was released in conjunction with the public disclosure; however, updated packages were not readily available from operating system (OS) vendors.
  • Monday, April 7, 2014 in the early afternoon – UW Office of the CISO staff became aware of the vulnerability. Immediately after learning of the vulnerability, CISO staff notified UW-IT Senior Leadership and individuals responsible for critical services about the vulnerability. UW-IT staff began assessing critical servers for exposure to the vulnerability right away.
  • Monday, April 7, 2014, at 3:47pm – An advisory with details about the vulnerability was sent to the UW TechSupport list by CISO staff.
  • Tuesday, April 8, 2014, in the morning – Updated OpenSSL software packages became available from most OS vendors.
  • Tuesday, April 8, 2014, by 1:40pm – UW-IT staff completed updating and restarting of the weblogin servers. Remediation of other critical UW-IT managed servers was completed later that day.
  • Wednesday, April 9, 2014 at 1:14pm – UW-IT Identity and Access Management  (IAM) team provided advice for affected SSL certificates to the UW TechSupport list.
  • Thursday, April 10, 2014 at 5:51pm – IAM and CISO teams sent a joint update to the UW TechSupport list.
  • Monday, April 14, 2014 – UW-IT published a story in IT Connect which references this UW Office of the CISO webpage.

Resources

You can find more information about the vulnerability and mitigation at the following links:

For questions, please contact help@uw.edu or ciso@uw.edu