Heartbleed Alexa top 10000

https://gist.github.com/dberkholz/10169691

by jmacd • 12 years ago

149 82 12 years ago

gist.github.com

Notable Sites:

yahoo.com indiegogo.com metacafe.com mybet.com nascar.com okcupid.com pch.com paypal-community.com browserstack.com creditkarma.com nasa.gov twitpic.com

The others are mostly porn sites, link shorteners, non-english or others people normally wouldn't have an account/put private data on. These are the sites I feel have the most significance on the list, sorry if I missed any.

level• 12 years ago

netflix.com is another big one

joshfraser• 12 years ago

Netflix has been fixed.

jackowayed• 12 years ago

Avast is pretty bad given that they make virus protection

thinkling• 12 years ago

Airbnb.com apache.org dreamhost.com ifttt.com wer ones I noticed.

There are a couple of big european retailers in the list (darty, castorama).

icodestuff• 12 years ago

As of earlier this morning Amazon.com was also vulnerable. OkCupid is also on this list.

elwell4• 12 years ago

flipboard.com

dcreemer• 12 years ago

We fixed it earlier today. Interesting wrinkle was that our SSL cert provider's web site was also vulnerable. We had to wait for them to update before reissuing the SSL certs.

rabino3• 12 years ago

slack.com

edit: I contacted the developers and they were super fast to patch everything, roll keys, etc. It's contained now.

esturk• 12 years ago

Notable edu sites:

(www)gatech.edu (www)ucla.edu (www)uiuc.edu

I mean really? These are top engineering schools too.

teawithcarl• 12 years ago

jd.com is huge in China.

lotsofcows• 12 years ago

Ha, what sort of idiot would have private data on a non-English site? Oh wait, that would be the majority of the population of the planet.

philip1209• 12 years ago

A browser extension that warns of vulnerability would be amazing.

josh-wrale3• 12 years ago

If someone builds this, please do not make the client actively poll the sites visited. Doing so seems likely, IMHO, to land you or even your users in jail for Computer Fraud and Abuse violations (e.g. someone visiting healthcare.gov).

https://en.wikipedia.org/wiki/Morris_worm

If you do this, reference a centralized list/registry. Don't risk the reputations of your users.

0xdeadbeefbabe2• 12 years ago

The fraud is that these vulnerable sites are risking their users' private data, while pretending they are not.

rplnt• 12 years ago

Can't you just check if heartbeat is enabled and poll what version of library is used? If no, could you check by setting the payload size lower than the payload? That way you know the site is vulnerable without receiving anything you shouldn't have received.

tlrobinson• 12 years ago

There's this, but I haven't tried it yet: https://github.com/PwnicornDev/heartbleed-test.crx

Mithrandir• 12 years ago

This bookmarklet works for me:

javascript:void(open('http://filippo.io/Heartbleed/#'+document.location.hostname))

achillean• 12 years ago

I'm updating the Shodan Chrome plugin atm to show the data that it's collecting on heartbleed:

https://chrome.google.com/webstore/detail/shodan/jjalcfnidlm...

molf• 12 years ago

So only a little over 12% is still vulnerable (and possibly ~30% not using OpenSSL). And that number is still shrinking quickly. For example: Netflix, Yahoo, NASA and OKCupid have updated in the mean time.

euphemize• 12 years ago

I've just checked a bunch of sites on this list and it seems a lot have been patched, only in the last hour since your comment.

Jare• 12 years ago

Also note that many non-SSL domains will be using SSL in subdomains, e.g. login.blahblah.com

robododo• 12 years ago

How many of these have gotten new server keys? How many have invalidated all prior session ids and cookies?

I have a feeling heartbleed will haunt us for a while.

JshWright• 12 years ago

Hopefully they patch OpenSSL before they roll their keys...

smtddr• 12 years ago

This will be similar to the trendnet webcam "/anony/mjpg.cgi" ordeal. To this day there are still many webcams on the internet that can be viewed by anyone and the owners of the webcam have no idea whatsoever.

We're going to have fallout from this for at least the rest of this year and well into the next.

3rd3• 12 years ago

Would it make sense for everyone to change their passwords because of this?

carbocation• 12 years ago

Many servers will still be vulnerable, so now you have 2 problems.

Zawinski meme aside, perhaps it would make sense to do it on a server-by-server basis when the machines are verified patched. (Though, even then, how do you know they aren't passing information back to an Internet-exposed-but-unpatched database server?)

regecks2• 12 years ago

If you logged in (as in, typed your username and password) in to the site during the time the exploit has been disclosed and the site has been vulnerable, I would change your password.

Otherwise, insist that the site owners invalidate all existing sessions.

belorn4• 12 years ago

This is the problem with a monoculture in security libraries. Back when the gnutls vulnerability came up earlier this year, some people seriously stated that we should only have one tls library and that would ensure the security of it.

Find a vulnerability in a browser, and a minority subset of all users get effected. Find a issue with openssl, and key to the kingdom is there.

rabino3• 12 years ago

Not sure I agree. More eyes in a library should mean it is more secure. I guess.

Having 200 broken TSL libraries is security by obscurity. Not very useful, and a pain for sysadmins.

bitwizzle• 12 years ago

It's not security by obscurity. It's security by diversity, which is arguably a good thing.

rodgerd• 12 years ago

There is OpenSSL, nss, and GnuTLS. That's 3. Two of those have had major breaches this year.

How many more libraries do you think will provide adequate security?

belorn4• 12 years ago

If each of those where equally used, and same with different key handling system, security by diversity would help. For example, the gnutls vulnerability only effected x509 resolving of the certificate chain, so those handful of people who use the pgp model were not effected.

Sadly, even if those options are available, gnutls is not common on the web, and https with pgp is even less common. Worse, some propose that we should use such options less in favor of one and only one library in the name of security.

ArloL• 12 years ago

Everyone should at least consider donating to the OpenSSL foundation: https://www.openssl.org/support/donations.html

rpearl• 12 years ago

They write terrible, terrible code. Can I donate to some smart people looking to replace OpenSSL with something reasonable?

newman314• 12 years ago

popsugar.com phpnuke.org toshiba.com torcache.net ucla.edu uiuc.edu utorrent.com ifttt.com

allochthon• 12 years ago

I'm hoping to find a list of largish sites that were vulnerable to this bug just prior to the recent disclosure, so that I can know how to prioritize my password changing. (These forced password rotations are happening quite a lot these days.)

jpmattia• 12 years ago

Anyone check banks and financial institutions yet?

voltagex_3• 12 years ago

The big four (?) banks in Australia seem to not be affected. I'm fairly sure they run IIS, anyway.

ezzaf• 12 years ago

The largest Australian bank (commbank) was reporting as vulnerable on filippo.io/Heartbleed/ for some hours after the vulnerability became known. GE Money Australia haven't fixed their vulnerability yet either.

hughes• 12 years ago

My bank (PC Financial) has been offline all evening. I wonder if it's related.

1_player• 12 years ago

UK Barclays is vulnerable.

patrickxb2• 12 years ago

Side question: Alexa still exists? People install that extension in their browser???

mkr-hn• 12 years ago

It's an extension now. SEO people seem to like it for the quick look at rankings.

Tloewald• 12 years ago

The question is, how much are its ratings worth based on who is using it?

ef47d35620c1• 12 years ago

It's a client problem too. Many people are over-looking that.

iscrewyou• 12 years ago

I've been looking everywhere for an answer but this may just be right place to ask.

What can a user or a client do to protect itself? Sites can patch things up (some sooner and some later). But meanwhile, what measures should the client take while waiting for the sites to be patched up?

regecks2• 12 years ago

Ask whoever wrote your client software to rebuild it with a new version of OpenSSL. Or, if its open source, try relink it yourself.

I guess through some convoluted MITM attack, somebody could (for example) try and exploit your email client, or similar.

elwell4• 12 years ago

Is there a quick way to test a site actively (i.e., without going and checking the openssl version)?

jetpks• 12 years ago

Yes. I've been using this tool: http://filippo.io/Heartbleed/

It was published in a comment in one of the other heartbleed threads.

elwell4• 12 years ago

This tool is just great, thanks!

sukuriant• 12 years ago

So, these are dumb questions; but,

1) was this list made legally?

2) is viewing the list legal?

pilom2• 12 years ago

1.) If it was made in the US, probably not. Reading the memory of a webserver would be pretty easy for a lawyer to argue is "unauthorized use of a computer system." That is the basic definition presented in the Computer Fraud and Abuse Act.

2.) I don't know enough to be able to argue one way or another on this point. However, if you download the list or disseminate the list you are likely increasing your possible exposure.

bpicolo• 12 years ago

Yes, it's entirely legal.

PeterisP• 12 years ago

The answer to (2) is Yes regardless of what is the answer to qestion (1).

FooBarWidget• 12 years ago

I'm sure all the serious sites will be updated soon. But what I'm more worried about is all those routers. My home router has an admin interface that's served over SSL. I'm not so confident in that manufacturers will push out updates for those routers quickly, or that people will update them at all.

elwell4• 12 years ago

Not sure if routers use TLS or just some utilities of OpenSSL. Could anyone confirm?

Narkov• 12 years ago

Home routers have bigger issues to worry about before they get to Heartbleed.

stormbrew• 12 years ago

This is a mixed bag, but I'd bet your router's running an older version than 1.0.1.

nsomething• 12 years ago

my ASUS router uses the 1.0.0 branch so it shouldn't be vulnerable to this bug

voltagex_3• 12 years ago

Hah, I'd be glad if my router used SSL. If anyone wants to fire up binwalk and run it over a few router firmwares, it'd make for an interesting blog post.

maximux• 12 years ago

I wish we could dump openssl and recompile all needed software to use polarssl

abc123xyz3• 12 years ago

Rapidshare is still vulnerable, search for "enc" session cookie, can login as any user then by editing this cookie :D it also works via their api

fun fun fun

abc123xyz3• 12 years ago

Still works...

http://i.imgur.com/RLXeySY.png

abc123xyz3• 12 years ago

http://api.rapidshare.com/cgi-bin/rsapi.cgi?sub=getaccountde...

accountid=46048788 firstname=mandeep lastname=sihag servertime=1397038309 addtime=1359871506 username=heavenlybeast directstart=1 country=IN mailflags=n language=en jsconfig= email=heavenlybeast@live.com curfiles=36 curspace=1213591844 rapids=0 billeduntil=0 nortuntil=0 maxspacegb=10 additionalspacegb=0 maxdaytrafficmb=100 additionaldaytrafficmb=0 traffictoday=20511350 accounttype=0 valid=1 payabo=0 promocode=0 promotype=0 promovaliduntil=0 maxfilesize=300000000

henryaj• 12 years ago

Heh. Alexa.com is on the list.

Heartbleed Alexa top 10000

Related Stories