The Internet has been abuzz for the last week or so in response to the Heartbleed vulnerability in OpenSSL. While almost all of the attention has centered on patching Web servers and advising users to change their passwords, security researchers have discovered that individual client PCs and devices are also at risk thanks to “Reverse Heartbleed.”
Meldium, a cloud identity and access management service, shared details of the Reverse Heartbleed threat in a blog post. An attacker can exploit Heartbleed to expose sensitive data on vulnerable servers, but that’s not the only attack possible using this flaw. The “heartbeat” used in the Heartbleed attack can be initiated by either the client or the server, so a malicious server can also send bad heartbeat packets to an OpenSSL client to extract data.
“It’s the popularity and pervasiveness of the OpenSSL library that makes this vulnerability difficult to remediate fully,” said Tim Erlin, director of IT security and risk strategy for Tripwire. “While popular Web applications may be already patched, the myriad of appliances, embedded devices, and network infrastructure that may be vulnerable will take a lot longer to address. You can’t just disable the Internet for maintenance.”
OpenSSL is a widely-used implementation of SSL, used in a diverse array of devices to secure Internet communications. Websites and online services are working diligently to patch and update in response to the Heartbleed threat, but browsers, applications, and connected devices that rely on OpenSSL are also potentially vulnerable to Heartbleed and/or Reverse Heartbleed. For example, both Cisco and Juniper have acknowledged that many of their home routers and networking devices are vulnerable.
According to Meldium, the server-initiated Reverse Heartbleed attack is slightly more difficult to successfully exploit for a few reasons. For instance, it can only be attempted once the TLS connection has been established. There are security controls used by some clients that will detect that the server certificate doesn’t match and abort the connection.
Meldium advises the same mitigation and remediation for Reverse Heartbleed as for Heartbleed, but stresses, “The important takeaway is that it’s not enough to patch your perimeter hosts—you need to purge bad OpenSSL versions from your entire infrastructure.”
The same holds true for individual home users. You should check with the developer or vendor for any software or devices that connect to the Internet to determine if they rely on OpenSSL and whether or not there is a patch available. Refrain from using any affected applications or devices, and apply any updates as soon as possible.
Meldium has created a Reverse Heartbleed Tester you can use to determine if you’re vulnerable.