The Heartbleed test adventure @ Hack.lu 2014

Transcript

1. The  Heartbleed  test   adventure Filippo  Valsorda
2. Filippo  Valsorda CloudFlare  security  team   @FiloSottile   I  mess  with  cryptography.   And  open  source.   ! {  https://  |  hi@  }  filippo.io
4. What  is   Heartbleed
5. Let’s  be  serious,   you  all  know  that!
6. When  I  found  out   first  thing  was  looking   at  the  commit (        )
8. OK,  so  it’s  the  length.   But  it’s  still  not  clear.   Let’s  check  the  RFC.
10. JACKPOT.   (why!?)
11. The  first  version. (A  small  wrapper  and  a  patch  to  crypto/tls)     • A  Go  tool
12. 66 LoC
13. 12 LoC
14. The  first  version. (Calling  the  tool  for  each  request)     • A  Go  tool   • A  Python  HTTP  API
15. 26 LoC
16. The  first  version. • A  Go  tool   • A  Python  HTTP  API   • A  GH  Pages  site (Static,  simple)    
18. And  suddenly…
19. The  traffic!
20. 2014-04-08T11:00:00Z (requests/min)
21. 2014-04-09T00:00:00Z
22. 2014-04-09T11:00:00Z
23. 2014-04-10T00:00:00Z
24. 2014-04-11T00:00:00Z
25. 2014-04-17T00:00:00Z
26. 2014-04-21T00:00:00Z
27. And on, and on…
28. 203,190,914  tests Total: in  the  first  14  days
29. The  site  evolved,  so   quickly  that  it  was   hard  keeping  up!
30. Initially  it  was  a  tool   for  industry  people
31. Then  the  new  users:   First  from  the  media
32. And  finally,   The  extensions!
33. The  final  setup Website:   Static,  hosted  on   GitHub  Pages
34. The  final  setup Backend:   Amazon  AWS,   EC2  behind  a  ELB   (40  of  them!)
35. The  final  setup Servers:   Pure  Go  concurrent   web/test  servers
36. The  final  setup SSL  (later):   CloudFlare
37. The  final  setup Cache  (way  later):   1hr  on  Amazon   NoSQL  (DynamoDB)
38. The  bug  :(
39. The  bug  :(
40. Logging
41. Logging Only  logged  results No  ads No  analytics
42. %  of  vulnerable  results
43. %  of  vulnerable  hosts
44. The  feedback
45. Help  with  the  code  
46. Credits  for  AWS
47. Donations
48. Reddit  AMA
49. And…  well,  people
50. And…  well,  people
51. Q?  A! @FiloSottile   {  https://  |  hi@  }  filippo.io