Urgent - System Updates - System Updates
-
In case you haven’t heard.
HEARTBLEED SSL vulnerability
Just watching Tech Snap about the detail of SSL exploit in “Heartbleat SSL session linker / extender”.
It is urgent to do a system update of any pools, mining equipment, web sites or exchanges.
This SSL vulnerability is easily exploited and critical to security. It is urgent and essential to patch your systems.
Feathercoin 0.8.6.1 - Hard Fork Update, inc. Heatbeat fix.
It would be advisable to prepare for the Feathercoind update 0.8.6.1, although a point release it contains major changes to Feathercoin transaction block frequency and other security updates, including updated SSL libraries.
Watch out for the Feathercoind 0.8.6.1 release announcement soon.
Re:
Patching GNU/Linux Kernel
http://www.digitaltrends.com/computing/how-to-update-ubuntu-plug-heartbleed-openssl-flaw/
Re: SSL Heartbeat
http://www.jupiterbroadcasting.com/54907/ssl-heartbreak-techsnap-157/
-
The Heartbleed bug
On New Year’s Eve 2011, German researcher and OpenSSL contributor Robin Seggelmann added code implementing a new feature called “heartbeats”.
The idea was straightforward: if a connection between two computers stays silent for too long, it is disconnected, so periodic “heartbeat” messages can keep the connection going.
As well as a simple “I’m here”, messages contain a arbitrary “payload” which is sent back and forth, a little like this:
Computer 1: “Hi, I’m still here, the payload is 5 characters long and is ‘12345’.”
Computer 2: “Hi, great, you’re still there, and your payload was 5 characters long and was ‘12345’.”
Unfortunately, Seggelmann’s code didn’t check that the payload was of the indicated length, so a malicious request could request more data than was in the payload:
Computer 1: “Hi, I’m still here, the payload is 50,000 characters long and is ‘12345’.”
Computer 2 would then send back a message with a payload of the requested length, the first characters of which would be the 12345 sent. The rest would be whatever happened to be in the computer’s memory next to the payload.
The exact contents sent back varied between systems and over time. But as well as information such as user passwords or private data, it could contain something called the private master key.
With access to this key, an “attacker” can electronically impersonate the organisation who rightfully owns the key, and unscramble all the private messages sent to that organisation â€" including old ones, if they’ve kept the previously unreadable scrambled versions.
Criminals could, for instance, steal the key of a major bank and then electronically impersonate it. It’s a potential field day for spies, too.
Ref:
http://phys.org/news/2014-04-heartbleed-bug-reveals-flaw-online.html
