OpenSSL.org hacked?

http://www.openssl.org/

by moeffju • 13 years ago

128 91 13 years ago

openssl.org

HCIdivision172• 13 years ago

For when the page is fixed, it currently says:

TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _

hobs• 13 years ago

Yeah I dont see it at this point, so fairly fast turnaround.

grogenaut4• 13 years ago

I've wondered this for quite a while but why isn't there a standard for browsers like <a href="bigassfile" checksumhref="checksumhrefforbigassfile" checksumalgo="shashamd19">Download with check</a> I mean no one ever checks them anyways so it's not like they're useful. The second step would to be to provide a reputable repo of software version -> checksum lookups so I didn't have to trust a given server for that. This is me thinking and drinking and I'd love comments.

khc• 13 years ago

1) hack high profile website 2) wait for it to be posted on hackernews 3) restore the page to appear normal, but embed a browser exploit 4) ... 5) profit!

srl• 13 years ago

Other pages are still up (although I haven't checked that they're unmodified) - it does appear the attacker didn't bother to bring anything but the front page down.

phaed2• 13 years ago

They did that on purpose, their intent seems to be to bring awareness rather than destruction.

stusmall• 13 years ago

An email works too :)

zaroth• 13 years ago

I tend not to click on links advertising pages that are hacked. You know, not that many zero days on Chrome, but still seems like a risky click, as they say.

sillysaurus2• 13 years ago

  $ curl www.openssl.org
  TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _

devdoomari• 13 years ago

but what if they set-up the server side so that the server returns different results depending on the browser/OS?

kaivi2• 13 years ago

Oh those turk hackers. Remember the mid-2000s, when searching google dork on a certain public exploit, one would most certainly find lots of already defaced websites? Even on some forsaken lice breeding forum with 2 users, there would always be mad photoshop collage with star and crescent on dark background, and a message to those few poor visitors, who probably would not even comprehend what is going on. Anyway, what's up with Turkey and hacking?

babuskov• 13 years ago

You can always run browser in a vitrual machine. Or open it with a text browser like Lynx or Links. Or use wget to download the file and read in text editor.

jrockway• 13 years ago

But what if the page uses HTML5 audio to "jump the gap" and reprogram all nearby electronic devices to attack you on 1/1/2014!?

pwnna• 13 years ago

I clicked and then I realized that I shouldn't have.

Luckily it seemed to have cleared.

Aaronn• 13 years ago

Posted on Twitter an hour ago: https://twitter.com/Turkguvenligi/status/417099879463129089

"openssl.org/ owned ;) http://zone-h.org/mirror/id/21425720 …"

jscheel• 13 years ago

Their security certificate still appears valid.

rhgraysonii• 13 years ago

Forgive me for the ignorance but why is this significant if at all? Honestly curious, not being facetious.

0x0• 13 years ago

If they can replace the front page html, they could probably also replace the source code distribution with a backdoored/trojaned tarball. Or someone else might already have done so, since who knows how long ago, using the same exploit.

userbinator• 13 years ago

But would they also be able to replace the public key of the authors in all the other places it appears on the Internet?

gcr• 13 years ago

This shows that website security depends on far more than just deploying over SSL.

yeukhon• 13 years ago

Who runs OpenSSL? Is it again volunteer? I think big companies need to step in and help creating infrastructure for these big projects.

gprasanth• 13 years ago

he took the best of us and tore it down. people will lose hope. (yet another batman reference)

almosnow3• 13 years ago

Is this the site that offered you free SSL certs?

borplk• 13 years ago

almosnow3• 13 years ago

Oh sorry, 'apt-get' has spoiled me (somehow I've never knew what was the official home of openssl).

Not cool at all, and apparently the guys running the site haven't took notice yet.

virtualSatai• 13 years ago

http://www.startssl.com/ does that.

kenrick2• 13 years ago

Who is in the favicon?

dangrossman3• 13 years ago

Nobody; it's the text "OpenSSL" squished into 16x16.

kenrick2• 13 years ago

almosnow3• 13 years ago

It just says OpenSSL

wzy• 13 years ago

they're back...

midas0073• 13 years ago

Yet another example of why to both sign release artifacts AND verify them is important.

Also, if you're running the public website for a security lib or core FOSS package, expect more attacks by kiddies trying to build rep... so very conservative tech choices (mostly static website served from a read-only fs) and defensive practices are de rigueur.

peterwwillis7• 13 years ago

What's the use in a static website or a read-only FS when you can overwrite what's in RAM, or just attack routing or DNS? Security is a little more complex.

markdown• 13 years ago

Ahh yes, the "if you can't turn it into Fort Knox, don't bother at all" guy.

Turning up at every security discussion since 1874.

orclev• 13 years ago

The point is to minimize attack surfaces. If you're serving static content that's one less path for an attacker to potentially exploit. With only static files exploits are limited to those contained in the web server or the OS network code. With a read only filesystem certain classes of privilege escalation are eliminated.

Attacks on routing or DNS are more difficult to deal with, but at least it isn't your server being compromised, and if you're using HTTPS properly then the certificate should show as invalid at least.

So yeah, security is complex, but his advice was spot on. The fact that you seem to call it into question says that you don't know much about security.

gtklocker4• 13 years ago

What is a good reason for openssl.org not to utilize HSTS[1]?

  $ curl -I https://www.openssl.org/
  HTTP/1.1 200 OK
  Date: Sun, 29 Dec 2013 03:57:54 GMT
  Server: Apache/2.2.22 (Ubuntu)
  Accept-Ranges: bytes
  Vary: Accept-Encoding
  Content-Length: 15686
  Content-Type: text/html

[1]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

peterwwillis7• 13 years ago

Because it doesn't need it. Technically no website needs it. Only people who don't know how to type "https" need it.

netik• 13 years ago

No. HSTS prevents SSLStrip attacks when the intended destination is always meant to be in SSL.

dionyziz4• 13 years ago

Which is, to say, 99.99% of people. Noone types "https://" or "http://"; 99% of people don't even know what https means. Us developers should know better and protect our users. It's our responsibility to make sure the default is secure.

gtklocker4• 13 years ago

Point is, I should not be able to access a plaintext version of a website hosting such cryptographically crucial software/information.

It's obvious why it can be a grand target for Man in the Middle, defacement and worst of all integrity attacks. Apart from preventing many of the latter, implementing HSTS could have really mitigated the problem. Anyone who had already visited the site wouldn't see the defaced page. Furthermore, they could get added to an STS preloaded list[1], making the attack invisible to anyone using a modern browser.

If you are interested, the Wikipedia page[2] does a fair job at explaining more about why HSTS is needed.

[1] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...

[2] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security...

davvid• 13 years ago

Does anyone have any details about how this was done? Was it a compromised admin account, a local root exploit, social engineering, etc? I'm eagerly awaiting the post-mortem.

lucb1e2• 13 years ago

No, and this is what makes it non-news. Especially since it links to the hacked webpage. Neither really Hacker nor News...

mackwic• 13 years ago

Hopefully, hacker has a meaning far more open than "security guys" or "security guys that know how to break things".

Sorry to prefer build things and creating value than destroy it.

I wonder why so many security guys are so condescending and contemptuous...

grogenaut4• 13 years ago

I said this in a lower thread but I figured it's better up here.

Why is there not a standard for links of this type in browsers. Eg <a href="url" sigurl="url to sig" sigalgo="algo to calculate signature">OpenSSL</a>

That's a simple way to go but I really think it's as generally insecure as reading a signature form a url that is advertised by a website. It's also why I rarely bother.

But if browsers were good about this then it could be done in a much better way which is to sign the application with a real peer verifiable signing method. Such as the SSL cert that covers the site behind the open source project .

now this only works for projects that have SSL certs. Another method would be to have a clearing house that can do 1-1 with github et al and a re cert, like a oss cert organization. A final good way would be to use the beauty of git and use the source checksums and a repeatable build process (which is fricking hard) and come up with a way to give a signature for oss applications based on a git commit and check that back to the public git repository.

really I think knwon public keys for oss projects and branches would be the real answer. And the security gating for newbs would be like windows and linux which check the public signature of the application before they run them from the web and make the end user feel safe instead of doing nothing.

Browsers have a good share in this responsibility as well. Standard domain security should work well here as well. Better than what we have.

I leave this to more entreprenurial minds to make this work and I'd love some real telegraph style sinkers to point out the flaws. This is must me talking after a belated xmas dinner. but I think I'm kind of on course.

jessaustin2• 13 years ago

Yeah the public key used for signing has to be communicated via a different channel, otherwise we're spinning our wheels. I think DNSSEC is headed in the right direction, but hasn't arrived yet.

But that's if we're talking websites in general. For the specific use here, installing "trusted" software packages, far better solutions already exist and already protected the users of OpenSSL.

s3yfullah• 13 years ago

Zone-H Mirror > http://www.zone-h.org/mirror/id/21425720

louwrentius• 13 years ago

The fact that the OpenSSL maintainers haven't communicated about this issue yet make me feel very uncomfortable.

ams6110• 13 years ago

Currently posted:

29-Dec-2013: Web site defacement. Investigation in progress, more details to follow.

OpenSSL.org hacked?

Related Stories