Featured Articles

LG G Watch R ships in two weeks

LG G Watch R ships in two weeks

The LG G Watch R, the first Android Wear watch with a truly round face, is coming soon and judging by…

More...
LG unveils NUCLUN big.LITTLE SoC

LG unveils NUCLUN big.LITTLE SoC

LG has officially announced its first smartphone SoC, the NUCLUN, formerly known as the Odin.

More...
Microsoft moves 2.4 million Xbox Ones

Microsoft moves 2.4 million Xbox Ones

Microsoft has announced that it move 2.4 million consoles in fiscal year 2015 Q1. The announcement came with the latest financial…

More...
Gainward GTX 970 Phantom previewed

Gainward GTX 970 Phantom previewed

Nvidia has released two new graphics cards based on its latest Maxwell GPU architecture. The Geforce GTX 970 and Geforce GTX…

More...
EVGA GTX 970 SC ACX 2.0 reviewed

EVGA GTX 970 SC ACX 2.0 reviewed

Nvidia has released two new graphics cards based on its latest Maxwell GPU architecture. The Geforce GTX 970 and Geforce GTX…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Monday, 28 April 2014 12:04

Heartbleed 2? It is all a myth

Written by Nick Farrell



Which is a female moth

Security experts have poured cold water on an OpenSSL vulnerability which a group of hackers have dubbed Heartbleed 2. A group of five hackers claimed on Pastebin that they have discovered another major security flaw in OpenSSL. They said they had found an vulnerability in the patched version OpenSSL. A missing bounds check in the handling of the variable DOPENSSL_NO_HEARTBEATS.

“We could successfully Overflow the DOPENSSL_NO_HEARTBEATS and retrieve 64kb chunks of data again on the updated version," they said.

The hackers said they would not make the vulnerability public as it would only allow companies to patch the flaw. They added they could exploit the flaw themselves "for a long time" before it gets patched, but they are also willing to sell it for $1,085.

"We are team of five people, and we have coded nonstop for 14 days to see if we could find a workaround, and we did it! We have no reason to make it public when the vendors will go for a update again," the group said.

The only evidence given that the vulnerability is realise this image of what appears to be the output from a server to a request from the attackers. However Security experts have pointed out that the DOPENSSL_NO_HEARTBEATS variable mentioned by the hackers doesn't actually exist.

The only identifier used by the hackers is the email address This e-mail address is being protected from spambots. You need JavaScript enabled to view it which, according to Softpedia, was previously used by groups selling user information from collapsed bitcoin exchange Mt. Gox. In other words if you fall for it, I have some shares in a bridge in Los Angeles I would like to sell you.

Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments