Re: OpenSSL development (Heartbleed)

[Natasha Kerensikova <lithiumcat@instinctive.eu>]

On 2014-04-23, Dmitry A. Kazakov <mailbox@dmitry-kazakov.de> wrote:
> On Wed, 23 Apr 2014 05:38:21 +0000 (UTC), Natasha Kerensikova wrote:
>
>> On 2014-04-22, Dmitry A. Kazakov <mailbox@dmitry-kazakov.de> wrote:
>>> Boundary checks or not, the transport layer shall have no access to the
>>> server data.
>>>
>>> A tightly coupled system is vulnerable. If compromising just one component
>>> opens all gates wide, that is a bad standard and bad design. The effects of
>>> errors and faults must be bounded per design. 
>> 
>> How would you design a transport layer that has no access to whatever is
>> supposed to be transported?
>> 
>> "Heartbleed" didn't leak any data that ins't legitimataly needed by
>> OpenSSL (i.e. transported data and/or transport parameters (like keys))
>
> I heard it leaked user data, I didn't go into details. I hope user data are
> not transported, because otherwise that would be even an greater design
> fault.

Actually it leaked session cookies, that are legitimately part of any
HTTP payload, and login/passwords, that are legitimately part of the
HTTP payload of the authentication request.

At that point the remaining of the user data is considered compromised
as well, because of the possibility of session/credential hijacking,
but that's only an indirect result of heartbleed, and requires a
separate attack.