Featured Articles

Snapdragon 400 is Qualcomm’s SoC for watches, wearables

Snapdragon 400 is Qualcomm’s SoC for watches, wearables

We wanted to learn a bit more about Qualcomm's plans for wearables and it turns out that the company believes its…

More...
Qualcomm sampling 20nm Snapdragon 810

Qualcomm sampling 20nm Snapdragon 810

We had a chance to talk to Michelle Leyden-Li, Senior Director of Marketing, QCT at Qualcomm and get an update on…

More...
EVGA GTX 970 SC ACX 2.0 reviewed

EVGA GTX 970 SC ACX 2.0 reviewed

Nvidia has released two new graphics cards based on its latest Maxwell GPU architecture. The Geforce GTX 970 and Geforce GTX…

More...
Nvidia GTX 980 reviewed

Nvidia GTX 980 reviewed

Nvidia has released two new graphics cards based on its latest Maxwell GPU architecture. The Geforce GTX 970 and Geforce GTX…

More...
PowerColor TurboDuo R9 285 reviewed

PowerColor TurboDuo R9 285 reviewed

Today we will take a look at the PowerColor TurboDuo Radeon R9 285. The card is based on AMD’s new…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Monday, 28 April 2014 12:04

Heartbleed 2? It is all a myth

Written by Nick Farrell



Which is a female moth

Security experts have poured cold water on an OpenSSL vulnerability which a group of hackers have dubbed Heartbleed 2. A group of five hackers claimed on Pastebin that they have discovered another major security flaw in OpenSSL. They said they had found an vulnerability in the patched version OpenSSL. A missing bounds check in the handling of the variable DOPENSSL_NO_HEARTBEATS.

“We could successfully Overflow the DOPENSSL_NO_HEARTBEATS and retrieve 64kb chunks of data again on the updated version," they said.

The hackers said they would not make the vulnerability public as it would only allow companies to patch the flaw. They added they could exploit the flaw themselves "for a long time" before it gets patched, but they are also willing to sell it for $1,085.

"We are team of five people, and we have coded nonstop for 14 days to see if we could find a workaround, and we did it! We have no reason to make it public when the vendors will go for a update again," the group said.

The only evidence given that the vulnerability is realise this image of what appears to be the output from a server to a request from the attackers. However Security experts have pointed out that the DOPENSSL_NO_HEARTBEATS variable mentioned by the hackers doesn't actually exist.

The only identifier used by the hackers is the email address This e-mail address is being protected from spambots. You need JavaScript enabled to view it which, according to Softpedia, was previously used by groups selling user information from collapsed bitcoin exchange Mt. Gox. In other words if you fall for it, I have some shares in a bridge in Los Angeles I would like to sell you.

Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments