The Heartbleed Test @ OWASP / NYU Poly

The story behind the https://filippo.io/Heartbleed test, how it worked and how it scaled from zero to performing 200 millions tests the first two weeks.

Talk given at the NYC OWASP meeting @ NYU Poly on Tue, June 24th 2014.

Recording: https://vimeo.com/99428593

Transcript

1. The Heartbleed test Filippo Valsorda
2. Filippo Valsorda @FiloSottile [hi@|www.]filippo.io
4. What  is   Heartbleed  
5. Let’s  be  serious,   you  all  know  that!  
6. When  I  found  out   first  thing  was   looking  at  the  commit   (        )  
8. OK,  so  it’s  the  length.   But  it’s  still  not  clear.   Let’s  check  the  RFC.  
10. JACKPOT.   (why!?)  
11. The  first  version.   (A  small  wrapper  and  a  patch  to  crypto/tls)       •  A  Go  tool  
12. 66 LoC
13. 12 LoC
14. The  first  version.   (Calling  the  tool  for  each  request)       •  A  Go  tool   •  A  Python  HTTP  API  
15. 26 LoC
16. The  first  version.   •  A  Go  tool   •  A  Python  HTTP  API   •  A  GH  Pages  site   (Static,  simple)      
18. And  suddenly…  
19. The  traffic!  
20. 2014-04-08T11:00:00Z (requests/min)
21. 2014-04-09T00:00:00Z
22. 2014-04-09T11:00:00Z
23. 2014-04-10T00:00:00Z
24. 2014-04-11T00:00:00Z
25. 2014-04-17T00:00:00Z
26. 2014-04-21T00:00:00Z
27. And on, and on…
28. 203,190,914  tests   Total:   in  the  first  14  days  
29. The  site  evolved,  so   quickly  that  it  was   hard  keeping  up!  
30. Initially  it  was  a  tool   for  industry  people  
31. Then  the  new  users:   First  from  the  media  
32. And  finally,   The  extensions!  
33. The  final  setup   Website:   Static,  hosted  on   GitHub  Pages  
34. The  final  setup   Backend:   Amazon  AWS,   EC2  behind  a  ELB   (40  of  them!)  
35. The  final  setup   Servers:   Pure  Go  concurrent   web/test  servers  
36. The  final  setup   SSL  (later):   CloudFlare  
37. The  final  setup   Cache  (way  later):   1hr  on  Amazon   NoSQL  (DynamoDB)  
38. The  bug  :(  
39. The  bug  :(  
40. Logging  
41. Logging   Only  logged  results   No  ads   No  analytics  
42. %  of  vulnerable  results  
43. %  of  vulnerable  hosts  
44. The  feedback  
45. Help  with  the  code  
46. Credits  for  AWS  
47. Donations  
48. Reddit  AMA  
49. And…  well,  people  
50. And…  well,  people  
51. Q?  A!   @FiloSottile   [hi@|www.]filippo.io