Heartbleed

[Anonymous]

By now you should have all heard about the Heartbleed flaw:

Here’s everything you need to know about the Heartbleed web security flaw — Tech News and Analysis

I just spoke to the Live content team and they are working on creating an application rule to detect Heartbleed activity. Hopefully it will be available in the next 24 hours.

[RSAAdmin]

It is a false positive - working on it now.

[RSAAdmin]

It is important for everyone to understand that the detection rule will ONLY trigger on HTTP.  You don't see server banners with an SSL session.

In server banners, if they are running a vulnerable version of open ssl, it shows up in risk.info.  Its a passive way to detect some vulnerable servers.  The rule can also be modified to look at just internal servers or external by appending org.dst exists or !exists

[huanzhou1]

In our SA system, the parser TLS actually detecting HTTPS/HTTP/IMAPS and other SSL traffic, although the server header cannot see.

[RSAAdmin]

Fielder was referring specifically to the rule for Heartbleed vulnerability detection that was folded into the TLS parsers, which relies on seeing a server header.  More specifically - it relies on seeing server meta, which will usually come from a server header in an HTTP session.

The TLS and Heartbleed exploit detection don't rely on seeing a server header.  They will work for any SSL traffic (HTTPS, SMTPS, IMAPS, etc...)

[huanzhou1]

So do you mean any traffic using heartbleed vulnerability to exploit even the server is not vulnerable will be tagged?

[RSAAdmin]

A successful Heartbleed attack will result in a risk.warning "heartbleed data leak", regardless of whether the risk.informational "openssl vulnerable to heartbleed" is registered or not.

Obviously, if an attack was successful then the server was vulnerable.  Fielder's point was that the risk.informational "openssl vulnerable to heartbleed" will only be registered for HTTP.

So, for example, an IMAPS server using a vulnerable OpenSSL version won't cause the "vulnerable" alert to be registered - but if it is successfully exploited it will still cause the "data leak" alert to be registered.

[huanzhou1]

I see, how is the false positive things?

[RSAAdmin]

I've updated the TLS parsers, but they haven't made it through QE to be published to Live yet.  I'll post when they're published.

[huanzhou1]

Just question: how to prove to the customer the parser is working correctly?

[RSAAdmin]

One way would be to import or tcpreplay pcaps of successful and failed exploit attempts to a decoder, and note if the meta is registered or not as appropriate.

Of course the customer may want to examine the pcaps to determine for themselves that they are representative. I can't share the pcaps that I have, but you or they could generate some by using the publicly available exploit code.