<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
	<channel>
		<title><![CDATA[DriverPacks.net Forum - "WPA2 wireless security cracked" & OpenSSL "HeartBleed" bug]]></title>
		<link>http://forum.driverpacks.net/viewtopic.php?id=10759</link>
		<description><![CDATA[The most recent posts in "WPA2 wireless security cracked" & OpenSSL "HeartBleed" bug.]]></description>
		<lastBuildDate>Fri, 11 Apr 2014 19:13:59 +0000</lastBuildDate>
		<generator>PunBB</generator>
		<item>
			<title><![CDATA[Re: "WPA2 wireless security cracked" & OpenSSL "HeartBleed" bug]]></title>
			<link>http://forum.driverpacks.net/viewtopic.php?pid=57418#p57418</link>
			<description><![CDATA[<p>Update:</p><div class="quotebox"><cite>Bruce Schneier wrote:</cite><blockquote><p>&quot;Cloudflare is reporting that it&#039;s very difficult, if not practically impossible, to steal SSL private keys with this attack.</p><div class="quotebox"><cite>CloudFare wrote:</cite><blockquote><p>Here&#039;s the good news: after extensive testing on our software stack, we have been unable to successfully use Heartbleed on a vulnerable server to retrieve any private key data. Note that is not the same as saying it is impossible to use Heartbleed to get private keys. We do not yet feel comfortable saying that. However, if it is possible, it is at a minimum very hard. And, we have reason to believe based on the data structures used by OpenSSL and the modified version of NGINX that we use, that it may in fact be impossible.&quot;<br /><em>&nbsp; &nbsp; &nbsp;<a href="http://blog.cloudflare.com/answering-the-critical-question-can-you-get-private-ssl-keys-using-heartbleed">http://blog.cloudflare.com/answering-th … heartbleed</a></em></p></blockquote></div><p><em>&nbsp; &nbsp; &nbsp;<a href="https://www.schneier.com/blog/archives/2014/04/more_on_heartbl.html">https://www.schneier.com/blog/archives/ … artbl.html</a></em></p></blockquote></div><p>The following was left in the aforementioned article&#039;s comments though:<br /></p><div class="quotebox"><cite>Ryan Ries wrote:</cite><blockquote><p>&quot;I&#039;ve already got about half of their private key, and I&#039;ve only been at it for ~ 3 hours.&quot;</p></blockquote></div>]]></description>
			<author><![CDATA[null@example.com (TechDud)]]></author>
			<pubDate>Fri, 11 Apr 2014 19:13:59 +0000</pubDate>
			<guid>http://forum.driverpacks.net/viewtopic.php?pid=57418#p57418</guid>
		</item>
		<item>
			<title><![CDATA[Re: "WPA2 wireless security cracked" & OpenSSL "HeartBleed" bug]]></title>
			<link>http://forum.driverpacks.net/viewtopic.php?pid=57417#p57417</link>
			<description><![CDATA[<p>Be careful what you wish for, <span style="color: royalblue">Outbreaker</span>!<br />&nbsp; The hunter may become the prey.</p><p>&nbsp; Wireless Routers can also be affected by the OpenSSL bug &quot;HeartBleed&quot;.&nbsp; Presumably, that would include routers with firmware built between early 2012 and April 7th, 2014.</p><div class="quotebox"><blockquote><p>&quot;Heartbleed seems to show that at least systems (read servers, clients, web appliances, phones, etc., etc.) encrypted with OpenSSL have potentially been vulnerable to wholesale pwnage, including certificates&quot; [cryptographic keys] &quot;, login details, financials, etc, etc. etc.&quot; [for the past two years]!<br />...<br /></p><div class="quotebox"><cite>Bruce Schneier wrote:</cite><blockquote><p>&quot;<strong><em>“Catastrophic” is the right word. On the scale of 1 to 10, this is an 11.</em></strong><br />Half a million sites are vulnerable, including my own.&quot;</p><p><em>&nbsp; &nbsp; &nbsp;Quoted from:&nbsp; <a href="https://www.schneier.com/blog/archives/2014/04/heartbleed.html">https://www.schneier.com/blog/archives/ … bleed.html</a></em></p></blockquote></div><p>&quot;Perhaps this is a good time to remember those wonderful words penned years ago by Douglas Adams: “DON’T PANIC”.</p><p>Be proactive, not reactive. Head’s up!&quot;</p><p><em>&nbsp; &nbsp; &nbsp;Quoted from:&nbsp; <a href="http://nuclear-news.net/2014/03/01/riseup-net-encryption-broken-japanese-against-nuclear-uk-januk-and-uk-activists-targetted-with-corrections/#comment-214077">http://nuclear-news.net/2014/03/01/rise … ent-214077</a></em></p><div class="quotebox"><blockquote><p><span style="color: grey">“Spock: Are you sure it isn’t time for a colorful metaphor? “&quot;<br /><em>&nbsp; &nbsp; &nbsp;Quoted from:&nbsp; <a href="http://www.imdb.com/title/tt0092007/quotes">http://www.imdb.com/title/tt0092007/quotes</a></em></span></p></blockquote></div></blockquote></div><p>This also includes software that utilizes OpenSSL in a Windows environment, even though Windows itself is not specifically indicated as vulnerable to this bug.</p><p>Add this to the WPA2 vulnerability, and that 11 on a ten-scale may in-effect actually be somewhere around an 18 on a ten-scale!<br />&nbsp; Of course, that is only in light of these two specific recent revelations and cannot include that which we are not yet aware of.</p><p>It also highlights how the assumption that open source makes such bugs unlikely in the long term is not necessarily true.<br />&nbsp; One does wonder how many bugs remain unofficially discovered or patched where Security By Obscurity prevails.</p><p>There may yet be another small set of updates officially released by Microsoft for NT5 in the near future.<br />&nbsp; That dealing with updated Certificates, as well as the many that have and will soon be Revoked.<br />&nbsp; &nbsp; Wondering if this is at least one reason the March 2014 Certificates update was yarded by MS.&nbsp; (don&#039;t know if NT6 update pulled too)</p><p>I wonder if Deutsche Bank properly fixed this yet, which allegedly is still using their old certificate.&nbsp; &nbsp; &nbsp;<img src="http://forum.driverpacks.net/img/smilies/hmm.png" width="15" height="15" alt="hmm" /><br />&nbsp; Business should be booming now for Certificate Authorities, yet one wonders how proactive they all were.<br />&nbsp; &nbsp; A chain will eventually break at it&#039;s weakest link if overloaded.</p>]]></description>
			<author><![CDATA[null@example.com (TechDud)]]></author>
			<pubDate>Fri, 11 Apr 2014 18:29:36 +0000</pubDate>
			<guid>http://forum.driverpacks.net/viewtopic.php?pid=57417#p57417</guid>
		</item>
		<item>
			<title><![CDATA[Re: "WPA2 wireless security cracked" & OpenSSL "HeartBleed" bug]]></title>
			<link>http://forum.driverpacks.net/viewtopic.php?pid=57409#p57409</link>
			<description><![CDATA[<p>Yeah free internet. <img src="http://forum.driverpacks.net/img/smilies/big_smile.png" width="15" height="15" alt="big_smile" /></p>]]></description>
			<author><![CDATA[null@example.com (Outbreaker)]]></author>
			<pubDate>Fri, 11 Apr 2014 15:49:22 +0000</pubDate>
			<guid>http://forum.driverpacks.net/viewtopic.php?pid=57409#p57409</guid>
		</item>
		<item>
			<title><![CDATA[Re: "WPA2 wireless security cracked" & OpenSSL "HeartBleed" bug]]></title>
			<link>http://forum.driverpacks.net/viewtopic.php?pid=57366#p57366</link>
			<description><![CDATA[<div class="quotebox"><cite>Inderscience Publishers quoting Achilleas Tsitroulis of Brunel University, UK, Dimitris Lampoudis of the University of Macedonia, Greece and Emmanuel Tsekleves of Lancaster University, UK wrote:</cite><blockquote><p>... &quot;this wireless security system might now be breached with relative ease by a malicious attack on a network. They suggest that it is now a matter of urgency that security experts and programmers work together to remove the vulnerabilities in WPA2 in order to bolster its security or to develop alternative protocols to keep our wireless networks safe from hackers and malware.&quot;</p></blockquote></div>]]></description>
			<author><![CDATA[null@example.com (TechDud)]]></author>
			<pubDate>Thu, 03 Apr 2014 07:17:44 +0000</pubDate>
			<guid>http://forum.driverpacks.net/viewtopic.php?pid=57366#p57366</guid>
		</item>
		<item>
			<title><![CDATA["WPA2 wireless security cracked" & OpenSSL "HeartBleed" bug]]></title>
			<link>http://forum.driverpacks.net/viewtopic.php?pid=57308#p57308</link>
			<description><![CDATA[<p>Heads up!&nbsp; &nbsp;<img src="http://forum.driverpacks.net/img/smilies/yikes.png" width="15" height="15" alt="yikes" />&nbsp; &nbsp; <span style="color: grey">Reference:</span>&nbsp; <em><a href="http://phys.org/news/2014-03-wpa2-wireless.html">http://phys.org/news/2014-03-wpa2-wireless.html</a></em></p><p>&nbsp; see also:&nbsp; <a href="http://phys.org/news/2014-02-scientists-contagious-airborne-wifi-virus.html#inlRlv">Scientists demonstrate first contagious airborne WiFi virus</a></p><p><em>Plug it in, plug it in!</em></p>]]></description>
			<author><![CDATA[null@example.com (TechDud)]]></author>
			<pubDate>Wed, 26 Mar 2014 01:22:33 +0000</pubDate>
			<guid>http://forum.driverpacks.net/viewtopic.php?pid=57308#p57308</guid>
		</item>
	</channel>
</rss>
