SlideShare a Scribd company logo
Please Listen Carefully
Heartbleed:
Over 66% of websites are believed to be
affected
Web users, beware.
There's a new security
bug that has been
discovered and is
described to be "one
of the greatest
threats to ever
surface the World
Wide Web," according
to The Clock Online.
The bug, nicknamed
Heart Bleed, was
discovered on April 8,
2014 by Google and
Codenomicon
engineers, but has
allegedly been around
the Internet for about
two years now.
Heart Bleed poses a huge threat to
consumers as it compromises sensitive
personal consumer information and its
attackers are untraceable.
If you're buying
something online and
enter something as
significant as your
credit card number…
Or if you are applying
for a job online and
enter personal
information such as
your address and
social security
number…
Heart Bleed can gain
access to all of that
information.
How does Heartbleed Work?
It begins with the
popular encryption
software OpenSSL.
OpenSSL is used all
over the Internet to
ensure user
information is secured
and encrypted.
Heartbleed means that
that information is now
vulnerable.
At the time of the
discovery, Yahoo.com
was the only major
Internet Company to
be affected by
Heartbleed.
FAQ
What makes the Heartbleed Bug
unique?
This bug has left large amount of private keys and
other secrets exposed to the Internet.
Considering the long exposure, ease of
exploitation, and attacks leaving no trace this
exposure should be taken seriously.
What does Heartbleed allow to leak?
Encryption is used to
protect secrets that may
harm your privacy or
security if they leak.
In order to coordinate
recovery, compromised
secrets have been
classified to four
categories:
1) primary key material
2) secondary key material
3) protected content
4) collateral
What is leaked
primary key material?
These are the crown jewels: the encryption keys themselves.
Leaked secret keys allow the attacker to decrypt any past and
future traffic to the protected services and to impersonate the
service at will. Any protection given by the encryption and the
signatures in the X.509 certificates can be bypassed.
Primary key material
Recovery
Recovery from this
leak requires patching
the vulnerability,
revocation of the
compromised keys
and reissuing and
redistributing new
keys.
Even doing all this will
still leave any traffic
intercepted by the
attacker in the past
still vulnerable to
decryption.
What is leaked secondary
key material?
These are for
example the user
credentials (user
names and
passwords) used
in the vulnerable
services.
Secondary key material
Recovery
Recovery from this leak
requires owners of the
service first to restore trust
to the service.
After this users can start
changing their passwords
and possible encryption
keys.
All session keys and session
cookies should be
invalidated and considered
compromised.
What is leaked
protected content?
This is the actual
content handled by
the vulnerable
services.
It may be personal or
financial details,
private
communication such
as emails or instant
messages, documents
or anything seen
worth protecting by
encryption.
Protected content
Recovery
Only owners of the services
will be able to estimate the
likelihood what has been
leaked and they should
notify their users
accordingly.
Most important thing is to
restore trust to the primary
and secondary key material
as described above. Only
this enables safe use of the
compromised services in
the future
What is leaked
collateral?
Leaked collateral are
other details that have
been exposed to the
attacker in leaked
memory content.
These may contain
technical details such
as memory addresses
and security measures
such as canaries used
to protect against
overflow attacks.
Collateral
Recovery
Collateral has only
contemporary value and
will lose their value to the
attacker when OpenSSL has
been upgraded to a fixed
version.

More Related Content

What's hot

Anatomy of a Spear Phishing Attack
Anatomy of a Spear Phishing AttackAnatomy of a Spear Phishing Attack
Anatomy of a Spear Phishing Attack
Mark Mair
 
Different Types of Phishing Attacks
Different Types of Phishing AttacksDifferent Types of Phishing Attacks
Different Types of Phishing Attacks
SysCloud
 
Best Practices to Protect Customer Data Effectively
Best Practices to Protect Customer Data EffectivelyBest Practices to Protect Customer Data Effectively
Best Practices to Protect Customer Data Effectively
Tentacle Cloud
 
Phishing scams in banking ppt
Phishing scams in banking pptPhishing scams in banking ppt
Phishing scams in banking ppt
Krishma Sandesra
 
Phishing & Pharming
Phishing & PharmingPhishing & Pharming
Phishing & Pharming
Devendra Yadav
 
P H I S H I N G
P H I S H I N GP H I S H I N G
P H I S H I N G
bensonoo
 
PPT on Phishing
PPT on PhishingPPT on Phishing
PPT on Phishing
Pankaj Yadav
 
Microsoft warns of potential attacks
Microsoft warns of potential attacksMicrosoft warns of potential attacks
Microsoft warns of potential attacks
John Davis
 
Attack chaining for web exploitation
Attack chaining for web exploitationAttack chaining for web exploitation
Attack chaining for web exploitation
n|u - The Open Security Community
 
Cyber security certification course
Cyber security certification courseCyber security certification course
Cyber security certification course
NishaPaunikar1
 
Phishing
PhishingPhishing
Newbytes NullHyd
Newbytes NullHydNewbytes NullHyd
Email phishing and countermeasures
Email phishing and countermeasuresEmail phishing and countermeasures
Email phishing and countermeasures
Jorge Sebastiao
 
Phishing
PhishingPhishing
Phishing
Sagar Rai
 
Phishing techniques
Phishing techniquesPhishing techniques
Phishing techniques
Sushil Kumar
 
Final report ethical hacking
Final report ethical hackingFinal report ethical hacking
Final report ethical hacking
samprada123
 
Detection of phishing websites
Detection of phishing websitesDetection of phishing websites
Detection of phishing websites
m srikanth
 
What is Phishing and How can you Avoid it?
What is Phishing and How can you Avoid it?What is Phishing and How can you Avoid it?
What is Phishing and How can you Avoid it?
Quick Heal Technologies Ltd.
 
The Mobile Lawyer: 2014
The Mobile Lawyer: 2014The Mobile Lawyer: 2014
The Mobile Lawyer: 2014
equaley
 
Cybersecurity presentation
Cybersecurity presentationCybersecurity presentation
Cybersecurity presentation
Jaimin Sanghvi
 

What's hot (20)

Anatomy of a Spear Phishing Attack
Anatomy of a Spear Phishing AttackAnatomy of a Spear Phishing Attack
Anatomy of a Spear Phishing Attack
 
Different Types of Phishing Attacks
Different Types of Phishing AttacksDifferent Types of Phishing Attacks
Different Types of Phishing Attacks
 
Best Practices to Protect Customer Data Effectively
Best Practices to Protect Customer Data EffectivelyBest Practices to Protect Customer Data Effectively
Best Practices to Protect Customer Data Effectively
 
Phishing scams in banking ppt
Phishing scams in banking pptPhishing scams in banking ppt
Phishing scams in banking ppt
 
Phishing & Pharming
Phishing & PharmingPhishing & Pharming
Phishing & Pharming
 
P H I S H I N G
P H I S H I N GP H I S H I N G
P H I S H I N G
 
PPT on Phishing
PPT on PhishingPPT on Phishing
PPT on Phishing
 
Microsoft warns of potential attacks
Microsoft warns of potential attacksMicrosoft warns of potential attacks
Microsoft warns of potential attacks
 
Attack chaining for web exploitation
Attack chaining for web exploitationAttack chaining for web exploitation
Attack chaining for web exploitation
 
Cyber security certification course
Cyber security certification courseCyber security certification course
Cyber security certification course
 
Phishing
PhishingPhishing
Phishing
 
Newbytes NullHyd
Newbytes NullHydNewbytes NullHyd
Newbytes NullHyd
 
Email phishing and countermeasures
Email phishing and countermeasuresEmail phishing and countermeasures
Email phishing and countermeasures
 
Phishing
PhishingPhishing
Phishing
 
Phishing techniques
Phishing techniquesPhishing techniques
Phishing techniques
 
Final report ethical hacking
Final report ethical hackingFinal report ethical hacking
Final report ethical hacking
 
Detection of phishing websites
Detection of phishing websitesDetection of phishing websites
Detection of phishing websites
 
What is Phishing and How can you Avoid it?
What is Phishing and How can you Avoid it?What is Phishing and How can you Avoid it?
What is Phishing and How can you Avoid it?
 
The Mobile Lawyer: 2014
The Mobile Lawyer: 2014The Mobile Lawyer: 2014
The Mobile Lawyer: 2014
 
Cybersecurity presentation
Cybersecurity presentationCybersecurity presentation
Cybersecurity presentation
 

Viewers also liked

Kashif Hamid CV
Kashif Hamid CVKashif Hamid CV
Kashif Hamid CV
Kashif Hamid Khan
 
CCDBG: Health and Safety Basics: Requirements for Certification
CCDBG: Health and Safety Basics: Requirements for CertificationCCDBG: Health and Safety Basics: Requirements for Certification
CCDBG: Health and Safety Basics: Requirements for Certification
Molly Oberholtzer
 
Déploiement d'applications pour Kubernetes
Déploiement d'applications pour KubernetesDéploiement d'applications pour Kubernetes
Déploiement d'applications pour Kubernetes
Smaïne KAHLOUCH
 
monopoly
monopolymonopoly
monopoly
avinash rana
 
Herramientas gerenciales 1
Herramientas gerenciales 1Herramientas gerenciales 1
Herramientas gerenciales 1
Maria Deciree Sarmiento
 
Jnn supports education
Jnn supports educationJnn supports education
Jnn supports education
JNNFoundationKE
 
Data's influence on the world
Data's influence on the worldData's influence on the world
Data's influence on the world
Raphael Oliel
 
Anti gun control
Anti gun controlAnti gun control
Anti gun control
schemel1
 
Jnn water project
Jnn water projectJnn water project
Jnn water project
JNNFoundationKE
 
«Масштабное пополнение ассортимента прожекторов Feron: многоматричные и Premium»
«Масштабное пополнение ассортимента прожекторов Feron: многоматричные и Premium»«Масштабное пополнение ассортимента прожекторов Feron: многоматричные и Premium»
«Масштабное пополнение ассортимента прожекторов Feron: многоматричные и Premium»
FeronLTD
 
Настольные лампы - классика
Настольные лампы - классикаНастольные лампы - классика
Настольные лампы - классика
FeronLTD
 
Аккумуляторные светильники серии ELxx
 Аккумуляторные светильники серии ELxx Аккумуляторные светильники серии ELxx
Аккумуляторные светильники серии ELxx
FeronLTD
 
Ba ssl
Ba sslBa ssl
The Body Shop
The Body ShopThe Body Shop
The Body Shop
Pia Thompson
 
18 кроків до виготовлення будиночку із сірників
18 кроків до виготовлення будиночку із сірників18 кроків до виготовлення будиночку із сірників
18 кроків до виготовлення будиночку із сірниківfalkovolodymyr
 

Viewers also liked (17)

Kashif Hamid CV
Kashif Hamid CVKashif Hamid CV
Kashif Hamid CV
 
CCDBG: Health and Safety Basics: Requirements for Certification
CCDBG: Health and Safety Basics: Requirements for CertificationCCDBG: Health and Safety Basics: Requirements for Certification
CCDBG: Health and Safety Basics: Requirements for Certification
 
Déploiement d'applications pour Kubernetes
Déploiement d'applications pour KubernetesDéploiement d'applications pour Kubernetes
Déploiement d'applications pour Kubernetes
 
monopoly
monopolymonopoly
monopoly
 
Herramientas gerenciales 1
Herramientas gerenciales 1Herramientas gerenciales 1
Herramientas gerenciales 1
 
Jnn supports education
Jnn supports educationJnn supports education
Jnn supports education
 
Data's influence on the world
Data's influence on the worldData's influence on the world
Data's influence on the world
 
Anti gun control
Anti gun controlAnti gun control
Anti gun control
 
Jnn water project
Jnn water projectJnn water project
Jnn water project
 
Twórcze spojrzenie
Twórcze spojrzenieTwórcze spojrzenie
Twórcze spojrzenie
 
«Масштабное пополнение ассортимента прожекторов Feron: многоматричные и Premium»
«Масштабное пополнение ассортимента прожекторов Feron: многоматричные и Premium»«Масштабное пополнение ассортимента прожекторов Feron: многоматричные и Premium»
«Масштабное пополнение ассортимента прожекторов Feron: многоматричные и Premium»
 
97 7
97  797  7
97 7
 
Настольные лампы - классика
Настольные лампы - классикаНастольные лампы - классика
Настольные лампы - классика
 
Аккумуляторные светильники серии ELxx
 Аккумуляторные светильники серии ELxx Аккумуляторные светильники серии ELxx
Аккумуляторные светильники серии ELxx
 
Ba ssl
Ba sslBa ssl
Ba ssl
 
The Body Shop
The Body ShopThe Body Shop
The Body Shop
 
18 кроків до виготовлення будиночку із сірників
18 кроків до виготовлення будиночку із сірників18 кроків до виготовлення будиночку із сірників
18 кроків до виготовлення будиночку із сірників
 

Similar to Heartbleed

Securing corporate assets_with_2_fa
Securing corporate assets_with_2_faSecuring corporate assets_with_2_fa
Securing corporate assets_with_2_fa
Hai Nguyen
 
A Novel Passwordless Authentication Scheme for Smart Phones Using Elliptic Cu...
A Novel Passwordless Authentication Scheme for Smart Phones Using Elliptic Cu...A Novel Passwordless Authentication Scheme for Smart Phones Using Elliptic Cu...
A Novel Passwordless Authentication Scheme for Smart Phones Using Elliptic Cu...
ADEIJ Journal
 
OlgerHoxha_Thesis_Final
OlgerHoxha_Thesis_FinalOlgerHoxha_Thesis_Final
OlgerHoxha_Thesis_Final
Olger Hoxha, CISSP CISM
 
Internet Security Essay
Internet Security EssayInternet Security Essay
Internet Security Essay
Best Online Paper Writing Service
 
Viruses, Biometrics, Encryption
Viruses, Biometrics, EncryptionViruses, Biometrics, Encryption
Viruses, Biometrics, Encryption
monroel
 
Online spying tools
Online spying toolsOnline spying tools
Online spying tools
farazmajeed27
 
Online spying tools
Online spying toolsOnline spying tools
Online spying tools
farazmajeed27
 
TM112 Meeting10-Dangerous Data.pptx
TM112 Meeting10-Dangerous Data.pptxTM112 Meeting10-Dangerous Data.pptx
TM112 Meeting10-Dangerous Data.pptx
MohammedYusuf609377
 
Five habits that might be a cyber security risk
Five habits that might be a cyber security riskFive habits that might be a cyber security risk
Five habits that might be a cyber security risk
K. A. M Lutfullah
 
Ipsec And Ssl Protocols ( Vpn )
Ipsec And Ssl Protocols ( Vpn )Ipsec And Ssl Protocols ( Vpn )
Ipsec And Ssl Protocols ( Vpn )
Monique Jones
 
Effects of using IT
Effects of using ITEffects of using IT
Effects of using IT
Mirza Ćutuk
 
Giarritano concept paper 4
Giarritano concept paper 4Giarritano concept paper 4
Giarritano concept paper 4
leahg118
 
Computer Secutity.
Computer Secutity.Computer Secutity.
Computer Secutity.
angelaag98
 
Edu 03 assingment
Edu 03 assingmentEdu 03 assingment
Edu 03 assingment
Aswani34
 
A Guide to Internet Security For Businesses- Business.com
A Guide to Internet Security For Businesses- Business.comA Guide to Internet Security For Businesses- Business.com
A Guide to Internet Security For Businesses- Business.com
Business.com
 
Chapter 2 System Security.pptx
Chapter 2 System Security.pptxChapter 2 System Security.pptx
Chapter 2 System Security.pptx
RushikeshChikane2
 
Computer_Hacking_for_Beginners_Kevin_James_complex.pdf
Computer_Hacking_for_Beginners_Kevin_James_complex.pdfComputer_Hacking_for_Beginners_Kevin_James_complex.pdf
Computer_Hacking_for_Beginners_Kevin_James_complex.pdf
xererenhosdominaram
 
Case 11. What exactly occurred Twitter is one of popular soci.docx
Case 11. What exactly occurred Twitter is one of popular soci.docxCase 11. What exactly occurred Twitter is one of popular soci.docx
Case 11. What exactly occurred Twitter is one of popular soci.docx
tidwellveronique
 
Puna 2015
Puna 2015Puna 2015
Puna 2015
Salaj Goyal
 
IRJET- Honeywords: A New Approach for Enhancing Security
IRJET- Honeywords: A New Approach for Enhancing SecurityIRJET- Honeywords: A New Approach for Enhancing Security
IRJET- Honeywords: A New Approach for Enhancing Security
IRJET Journal
 

Similar to Heartbleed (20)

Securing corporate assets_with_2_fa
Securing corporate assets_with_2_faSecuring corporate assets_with_2_fa
Securing corporate assets_with_2_fa
 
A Novel Passwordless Authentication Scheme for Smart Phones Using Elliptic Cu...
A Novel Passwordless Authentication Scheme for Smart Phones Using Elliptic Cu...A Novel Passwordless Authentication Scheme for Smart Phones Using Elliptic Cu...
A Novel Passwordless Authentication Scheme for Smart Phones Using Elliptic Cu...
 
OlgerHoxha_Thesis_Final
OlgerHoxha_Thesis_FinalOlgerHoxha_Thesis_Final
OlgerHoxha_Thesis_Final
 
Internet Security Essay
Internet Security EssayInternet Security Essay
Internet Security Essay
 
Viruses, Biometrics, Encryption
Viruses, Biometrics, EncryptionViruses, Biometrics, Encryption
Viruses, Biometrics, Encryption
 
Online spying tools
Online spying toolsOnline spying tools
Online spying tools
 
Online spying tools
Online spying toolsOnline spying tools
Online spying tools
 
TM112 Meeting10-Dangerous Data.pptx
TM112 Meeting10-Dangerous Data.pptxTM112 Meeting10-Dangerous Data.pptx
TM112 Meeting10-Dangerous Data.pptx
 
Five habits that might be a cyber security risk
Five habits that might be a cyber security riskFive habits that might be a cyber security risk
Five habits that might be a cyber security risk
 
Ipsec And Ssl Protocols ( Vpn )
Ipsec And Ssl Protocols ( Vpn )Ipsec And Ssl Protocols ( Vpn )
Ipsec And Ssl Protocols ( Vpn )
 
Effects of using IT
Effects of using ITEffects of using IT
Effects of using IT
 
Giarritano concept paper 4
Giarritano concept paper 4Giarritano concept paper 4
Giarritano concept paper 4
 
Computer Secutity.
Computer Secutity.Computer Secutity.
Computer Secutity.
 
Edu 03 assingment
Edu 03 assingmentEdu 03 assingment
Edu 03 assingment
 
A Guide to Internet Security For Businesses- Business.com
A Guide to Internet Security For Businesses- Business.comA Guide to Internet Security For Businesses- Business.com
A Guide to Internet Security For Businesses- Business.com
 
Chapter 2 System Security.pptx
Chapter 2 System Security.pptxChapter 2 System Security.pptx
Chapter 2 System Security.pptx
 
Computer_Hacking_for_Beginners_Kevin_James_complex.pdf
Computer_Hacking_for_Beginners_Kevin_James_complex.pdfComputer_Hacking_for_Beginners_Kevin_James_complex.pdf
Computer_Hacking_for_Beginners_Kevin_James_complex.pdf
 
Case 11. What exactly occurred Twitter is one of popular soci.docx
Case 11. What exactly occurred Twitter is one of popular soci.docxCase 11. What exactly occurred Twitter is one of popular soci.docx
Case 11. What exactly occurred Twitter is one of popular soci.docx
 
Puna 2015
Puna 2015Puna 2015
Puna 2015
 
IRJET- Honeywords: A New Approach for Enhancing Security
IRJET- Honeywords: A New Approach for Enhancing SecurityIRJET- Honeywords: A New Approach for Enhancing Security
IRJET- Honeywords: A New Approach for Enhancing Security
 

Recently uploaded

How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
Chart Kalyan
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
Pixlogix Infotech
 
20240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 202420240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 2024
Matthew Sinclair
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
akankshawande
 
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing InstancesEnergy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Alpen-Adria-Universität
 
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdfMonitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Tosin Akinosho
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
Zilliz
 
Choosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptxChoosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptx
Brandon Minnick, MBA
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Safe Software
 
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
DianaGray10
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
Octavian Nadolu
 
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy SurveyTrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc
 
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Speck&Tech
 
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfUnlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Malak Abu Hammad
 
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with SlackLet's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
shyamraj55
 
5th LF Energy Power Grid Model Meet-up Slides
5th LF Energy Power Grid Model Meet-up Slides5th LF Energy Power Grid Model Meet-up Slides
5th LF Energy Power Grid Model Meet-up Slides
DanBrown980551
 
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptxHow to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
danishmna97
 
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial IntelligenceAI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
IndexBug
 
Presentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of GermanyPresentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of Germany
innovationoecd
 
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying AheadDigital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Wask
 

Recently uploaded (20)

How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
 
20240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 202420240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 2024
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
 
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing InstancesEnergy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
 
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdfMonitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdf
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
 
Choosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptxChoosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptx
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
 
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
 
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy SurveyTrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy Survey
 
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?
 
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfUnlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
 
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with SlackLet's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
 
5th LF Energy Power Grid Model Meet-up Slides
5th LF Energy Power Grid Model Meet-up Slides5th LF Energy Power Grid Model Meet-up Slides
5th LF Energy Power Grid Model Meet-up Slides
 
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptxHow to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
 
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial IntelligenceAI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
 
Presentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of GermanyPresentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of Germany
 
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying AheadDigital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
 

Heartbleed

  • 2. Heartbleed: Over 66% of websites are believed to be affected
  • 3. Web users, beware. There's a new security bug that has been discovered and is described to be "one of the greatest threats to ever surface the World Wide Web," according to The Clock Online.
  • 4. The bug, nicknamed Heart Bleed, was discovered on April 8, 2014 by Google and Codenomicon engineers, but has allegedly been around the Internet for about two years now.
  • 5. Heart Bleed poses a huge threat to consumers as it compromises sensitive personal consumer information and its attackers are untraceable.
  • 6. If you're buying something online and enter something as significant as your credit card number…
  • 7. Or if you are applying for a job online and enter personal information such as your address and social security number…
  • 8. Heart Bleed can gain access to all of that information.
  • 9. How does Heartbleed Work? It begins with the popular encryption software OpenSSL. OpenSSL is used all over the Internet to ensure user information is secured and encrypted. Heartbleed means that that information is now vulnerable.
  • 10. At the time of the discovery, Yahoo.com was the only major Internet Company to be affected by Heartbleed.
  • 11. FAQ
  • 12. What makes the Heartbleed Bug unique? This bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation, and attacks leaving no trace this exposure should be taken seriously.
  • 13. What does Heartbleed allow to leak? Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery, compromised secrets have been classified to four categories: 1) primary key material 2) secondary key material 3) protected content 4) collateral
  • 14. What is leaked primary key material? These are the crown jewels: the encryption keys themselves. Leaked secret keys allow the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed.
  • 15. Primary key material Recovery Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption.
  • 16. What is leaked secondary key material? These are for example the user credentials (user names and passwords) used in the vulnerable services.
  • 17. Secondary key material Recovery Recovery from this leak requires owners of the service first to restore trust to the service. After this users can start changing their passwords and possible encryption keys. All session keys and session cookies should be invalidated and considered compromised.
  • 18. What is leaked protected content? This is the actual content handled by the vulnerable services. It may be personal or financial details, private communication such as emails or instant messages, documents or anything seen worth protecting by encryption.
  • 19. Protected content Recovery Only owners of the services will be able to estimate the likelihood what has been leaked and they should notify their users accordingly. Most important thing is to restore trust to the primary and secondary key material as described above. Only this enables safe use of the compromised services in the future
  • 20. What is leaked collateral? Leaked collateral are other details that have been exposed to the attacker in leaked memory content. These may contain technical details such as memory addresses and security measures such as canaries used to protect against overflow attacks.
  • 21. Collateral Recovery Collateral has only contemporary value and will lose their value to the attacker when OpenSSL has been upgraded to a fixed version.