Quote from: dyask on April 10, 2014, 11:27:15 PM

Quote from: NLNico on April 10, 2014, 01:10:10 PM

Quote from: dyask on April 10, 2014, 12:48:53 PM

Quote from: NLNico on April 10, 2014, 12:16:33 PM

Quote from: dyask on April 10, 2014, 05:23:52 AM

Quote from: NLNico on April 10, 2014, 05:06:28 AM

That page says "btc-arbs.com IS VULNERABLE. " ?

No it is fine. That test can give a false positive when load is high.

What are you talking about? It gives part of the memory as proof :s

Just to be clear: anyone using BTC-arbs last few days should be very careful. An attacker can steal user's cookies/password as long as btc-arbs.com has this OpenSSL vulnerability. I recommend to not use this site until this vulnerability is fixed.

And well, obviously I recommend to not use them at all since months already but yeh. ~~Will be perfect end for ponzi too "ah shit, got hacked".~~

What? Now you are just spreading FUD!

Why? With this vulnerability attackers can get ~64KB of random data from the memory, and an attacker can keep doing this to get more memory data. In the memory data there can be sessions IDs of users so the attacker can take over their session and for example do a BTC withdrawal. This is widely documented already, for example: https://www.mattslifebytes.com/?p=533 , https://www.michael-p-davis.com/using-heartbleed-for-hijacking-user-sessions/ , etc. and the scripts for it are pretty easy to find too.

Do you really enjoy people losing their money or something? I am just trying to warn people for a serious security vulnerability :\

Where is your proof that BTC-arbs is open to this vulnerability? The test site used early in this thread cleared the site. This is only a problem with unpatched openSSL 1.01. In the meantime you are just whipping up the fear you have been trying since the beginning of this thread.

Heartbleed could end up having a HUGE IMPACT on the internet. And it's not just 1.01, it's 1.01-1.01f. This has been around for about two years, and it could have been exploited during that whole time. 64kb of data times many requests can get you a lot of info.

If you don't know anything about Heartbleed, you should read about it at http://heartbleed.com/. The worst case scenario is not hackers just stealing usernames and passwords, but acquiring the encryption keys and being able to read ALL the traffic between the server and users (including in the past) and being able to impersonate the server at will.

I checked BTC Arbs on http://filippo.io/Heartbleed/ and with Chromebleed Checker at the time of my post about it, and they both said it was vulnerable. Rechecking now says that it's okay, so BTC Arbs must have fixed it. Although BTC Arbs mentioned Heartbleed in the reports, they didn't say anything about their own vulnerability. They are just reminding everyone about 2FA (isn't that vulnerable to Heartbleed anyway?).

It doesn't look like they revoked the certificate, so they haven't gone that far in patching the vulnerability.

TheAwer

Posts

Merits