Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
The Heartbleed test adventure @ Hack.lu 2014
Search
Filippo Valsorda
October 21, 2014
Programming
0
140
The Heartbleed test adventure @ Hack.lu 2014
Filippo Valsorda
October 21, 2014
Tweet
Share
More Decks by Filippo Valsorda
See All by Filippo Valsorda
Asynchronous networking @ GopherCon 2018
filosottile
3
2k
Le note cifrate di Antonio Marzi
filosottile
1
370
Why cgo is slow @ CapitalGo 2018
filosottile
2
4.4k
Squeezing a key through a carry bit @ 34c3
filosottile
0
1.6k
Calling Rust from Go, without cgo @ GothamGo 2017
filosottile
1
2.6k
You, latency and profiling @ GolangUK 2017
filosottile
0
1.1k
Encrypting the Internet with Go @ GopherCon 2017
filosottile
9
2.6k
You, latency and profiling @ GopherCon India 2017
filosottile
13
4k
TLS 1.3 @ 33c3
filosottile
4
6.7k
Other Decks in Programming
See All in Programming
PRレビューのお供にDanger
stoticdev
1
240
sappoRo.R #12 初心者セッション
kosugitti
0
280
Unity Android XR入門
sakutama_11
0
180
AWS Step Functions は CDK で書こう!
konokenj
4
220
第3回関東Kaggler会_AtCoderはKaggleの役に立つ
chettub
3
1.2k
一休.com のログイン体験を支える技術 〜Web Components x Vue.js 活用事例と最適化について〜
atsumim
0
1.1k
はじめての Go * WASM *OCR
sgash708
1
110
color-scheme: light dark; を完全に理解する
uhyo
7
500
自力でTTSモデルを作った話
zgock999
0
110
ML.NETで始める機械学習
ymd65536
0
230
もう少しテストを書きたいんじゃ〜 #phpstudy
o0h
PRO
18
4.1k
Djangoにおける複数ユーザー種別認証の設計アプローチ@DjangoCongress JP 2025
delhi09
PRO
4
490
Featured
See All Featured
Practical Orchestrator
shlominoach
186
10k
Into the Great Unknown - MozCon
thekraken
35
1.6k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
27
1.9k
KATA
mclloyd
29
14k
The MySQL Ecosystem @ GitHub 2015
samlambert
250
12k
Fashionably flexible responsive web design (full day workshop)
malarkey
406
66k
Embracing the Ebb and Flow
colly
84
4.6k
The Power of CSS Pseudo Elements
geoffreycrofte
75
5.5k
The Pragmatic Product Professional
lauravandoore
32
6.4k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
28
9.3k
Building a Scalable Design System with Sketch
lauravandoore
461
33k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
32
2.1k
Transcript
The Heartbleed test adventure Filippo Valsorda
Filippo Valsorda CloudFlare security team @FiloSottile I mess
with cryptography. And open source. ! { https:// | hi@ } filippo.io
None
What is Heartbleed
Let’s be serious, you all know that!
When I found out first thing was looking
at the commit ( )
None
OK, so it’s the length. But it’s still not
clear. Let’s check the RFC.
None
JACKPOT. (why!?)
The first version. (A small wrapper and a patch to
crypto/tls) • A Go tool
66 LoC
12 LoC
The first version. (Calling the tool for each request)
• A Go tool • A Python HTTP API
26 LoC
The first version. • A Go tool • A
Python HTTP API • A GH Pages site (Static, simple)
None
And suddenly…
The traffic!
2014-04-08T11:00:00Z (requests/min)
2014-04-09T00:00:00Z
2014-04-09T11:00:00Z
2014-04-10T00:00:00Z
2014-04-11T00:00:00Z
2014-04-17T00:00:00Z
2014-04-21T00:00:00Z
And on, and on…
203,190,914 tests Total: in the first 14 days
The site evolved, so quickly that it was
hard keeping up!
Initially it was a tool for industry people
Then the new users: First from the media
And finally, The extensions!
The final setup Website: Static, hosted on GitHub
Pages
The final setup Backend: Amazon AWS, EC2 behind
a ELB (40 of them!)
The final setup Servers: Pure Go concurrent web/test
servers
The final setup SSL (later): CloudFlare
The final setup Cache (way later): 1hr on Amazon
NoSQL (DynamoDB)
The bug :(
The bug :(
Logging
Logging Only logged results No ads No analytics
% of vulnerable results
% of vulnerable hosts
The feedback
Help with the code
Credits for AWS
Donations
Reddit AMA
And… well, people
And… well, people
Q? A! @FiloSottile { https:// | hi@ } filippo.io