Featured Articles

AMD SVP John Byrne named turnaround exec of the year

AMD SVP John Byrne named turnaround exec of the year

Director of AMD’s PR Chris Hook has tweeted and confirmed later in a conversation with Fudzilla that John Byrne, Senior Vice…

More...
Shield Tablet 8 launching on Tuesday July 22nd

Shield Tablet 8 launching on Tuesday July 22nd

We knew the date for a while but as of right now we can confirm that Nvidia’s new Shield Tablet 8,…

More...
AMD confirms 20nm in 2015

AMD confirms 20nm in 2015

Lisa Su, Senior Vice President and Chief Operating Officer, AMD, has confirmed what we told you back in May 2014 – …

More...
AMD reports loss, shares tumble

AMD reports loss, shares tumble

AMD’s debt load is causing huge problems for the chipmaker -- this quarter it had another substantial loss. The tame Apple Press…

More...
AMD A8-7600 Kaveri APU reviewed

AMD A8-7600 Kaveri APU reviewed

Today we'll take a closer look at AMD's A8-7600 APU Kaveri APU, more specifically we'll examine the GPU performance you can…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Monday, 28 April 2014 12:04

Heartbleed 2? It is all a myth

Written by Nick Farrell



Which is a female moth

Security experts have poured cold water on an OpenSSL vulnerability which a group of hackers have dubbed Heartbleed 2. A group of five hackers claimed on Pastebin that they have discovered another major security flaw in OpenSSL. They said they had found an vulnerability in the patched version OpenSSL. A missing bounds check in the handling of the variable DOPENSSL_NO_HEARTBEATS.

“We could successfully Overflow the DOPENSSL_NO_HEARTBEATS and retrieve 64kb chunks of data again on the updated version," they said.

The hackers said they would not make the vulnerability public as it would only allow companies to patch the flaw. They added they could exploit the flaw themselves "for a long time" before it gets patched, but they are also willing to sell it for $1,085.

"We are team of five people, and we have coded nonstop for 14 days to see if we could find a workaround, and we did it! We have no reason to make it public when the vendors will go for a update again," the group said.

The only evidence given that the vulnerability is realise this image of what appears to be the output from a server to a request from the attackers. However Security experts have pointed out that the DOPENSSL_NO_HEARTBEATS variable mentioned by the hackers doesn't actually exist.

The only identifier used by the hackers is the email address This e-mail address is being protected from spambots. You need JavaScript enabled to view it which, according to Softpedia, was previously used by groups selling user information from collapsed bitcoin exchange Mt. Gox. In other words if you fall for it, I have some shares in a bridge in Los Angeles I would like to sell you.

Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments