Cracking Cloudflare's heartbleed challenge

https://blog.indutny.com/9.heartbleed

by tomkwok • 12 years ago

198 30 12 years ago

blog.indutny.com

tomkwok2• 12 years ago

Which one's better: https://github.com/indutny/heartbleed (in node.js) or https://github.com/robertdavidgraham/heartleech (in C)?

einaros5• 12 years ago

I've published another toolset in Python here: https://github.com/einaros/heartbleed-tools

The final test I did before publishing yielded ~100Mbit/sec of bleed from the challenge server, and had the prime in a few secs.

I also detailed a couple of other challenge observations here: https://hacking.ventures/rsa-keys-in-heartbleed-memory/

chubot• 12 years ago

Thanks for publishing. FWIW I tried your tools, and it said my server Nginx HTTPS was vulnerable, but I couldn't get any keys out of it. I created a 180MB dump file, and then scanned it, and it finished without finding keys (and I repeated this again)

I also tried the code you linked here: https://news.ycombinator.com/item?id=7577659

This also failed, and it actually said my server was likely not vulnerable?

I compiled my own Nginx, (but not my own SSL, that came from Debian 7.0 Wheezy)

Linux ... 3.9.3-x86_64-linode33 #1 SMP Mon May 20 10:22:57 EDT 2013 x86_64 GNU/Linux

OpenSSL 1.0.1e 11 Feb 2013

I just upgraded the Debian libssl1.0.0 package, and now your code says I am safe. I see there is the len(all_data) > 24 check.

Should compiling my own Nginx have any effect on whether the exploit works? I would think not, but 2 different exploits failed (although maybe I didn't run it long enough).

FWIW it was Nginx 1.0.12.

EDIT: FWIW, now that I read Cloudflare's results, they think the Nginx server is only vulnerable shortly after being restarted. My server was running for months, which may have explained why it wasn't vulnerable. Oh well.

http://blog.cloudflare.com/the-results-of-the-cloudflare-cha...

sp3325• 12 years ago

I couldn't get heartleech to build at all. The Makefile is malformed, for a start.

juhanima• 12 years ago

Yes, but you don't really need the Makefile. Just check out README.md and do as it says, and it should build just fine. Actually just

$ gcc -o heartleech -lcrypto -lssl -ldl heartleech.c

might work dependening a bit on the distro. Seems to work, too.

dasil003• 12 years ago

Maybe the reported byte length was incorrect.

Malus• 12 years ago

That is because the tab on line 4 was converted to 4 spaces. A simple find + replace fixes the problem.

indutny3• 12 years ago

I think it is a matter of taste mostly, they all use similar method, I think

jgrahamc• 12 years ago

This is the code used by the first person to extract the private key.

tomkwok2• 12 years ago

And as he mentioned, it's a node.js script (plus the node-v0.10.26.patch).

filipedeschamps• 12 years ago

Thank you for the post explaining.

It's great to have good guys like you around. Keep up with the good job.

sp3325• 12 years ago

indutny: your sibling comment is dead because it's the exact same text as your previous comment, and HN code killed it as a double-post. https://news.ycombinator.com/item?id=7576670 <- from 3 days ago lol

indutny3• 12 years ago

Thanks for letting me know. I'll try to be unpredictable.

user2994cb• 12 years ago

Nice. To speed things up, you could look for 128 byte malloc'ed chunks with a 16 byte header of "xx xx xx xx 90 00 00 00" or "xx xx xx xx 91 00 00 00" (for a 2048 bit modulus).

Looks to me like OpenSSL caches the modulus for Montgomery multiplication and that's where the primes in higher memory are coming from (see rsa_eay.c around line 774).

gojomo• 12 years ago

An interesting variant of prime-number search. It may not turn up the largest primes yet known... just the economically valuable smaller ones.

Cracking Cloudflare's heartbleed challenge

Related Stories