Re: Heartbleed - attacks?

[Alan Browne <alan.browne@FreelunchVideotron.ca>]

On 2014.04.10, 22:39 , Charles H. Sampson wrote:
>       According to Wikipedia, the Heartbleed bug in OpenSSL is caused by
> two errors: Lack of bounds checking and failure to verify that the
> heartbeat request was valid. Whom does one express one's indignation to?
> The insistence of many in our "profession" on using C and its decendents
> is the reason I qualify the word "profession" when writing about
> software developers. Acting on a message without validating it is
> equally incomprenhensible to me. The former is a "profession"-wide
> problem. For the latter, someone needs a severe rebuke on his next
> performance review, at the least.
>
>       It so happens that for the last project I worked on, I was
> responsible for TCP/IP communication. Every incoming message was fully
> validated, including validating all components of the message body. The
> only response to an invalid message was a negative acknowledgement to
> the sender. It never occurred to me to do it any other way. Haven't the
> problems associated with acting on invalid input of any sort been known
> for decades?

As far as the above may be (is) true, according to this article:
http://bits.blogs.nytimes.com/2014/04/16/study-finds-no-evidence-of-heartbleed-attacks-before-the-bug-was-exposed/?src=me

There were no "attacks" due to heartbleed.

OTOH, a 19 year old in London, ON, has been arrested for accessing some 
900 people's tax info via the Canadian Revenue Agency (aka: taxman) tax 
filing servers using the HB exploit.

Whether this attack was made after HB was announced (and before the CRA 
closed their web portal) is not clear to me.  Looks to me like a 
"bright" kid screwing around without intended malice is being ground up 
by the RCMP just so they can say justice is being done.  (aka: closing 
the barn door after the horses have fled).

-- 
"Big data can reduce anything to a single number,
  but you shouldn’t be fooled by the appearance of exactitude."
      -Gary Marcus and Ernest Davis, NYT, 2014.04.07