Private Crypto Keys Are Accessible to Heartbleed Hackers: Data Shows

[Turk.]

By Megan Geuss Apr 13 2014, 8:30am AEST
Four people have been able to see server keys and certificates in a test.


Contrary to previous suspicions, it is possible for hackers exploiting the catastrophic vulnerability dubbed Heartbleed to extract a private encryption keys from vulnerable websites, Web services firm Cloudflare reported Saturday.

As recently as yesterday, Cloudflare published preliminary findings that seemed to indicate that it would be difficult, if not impossible, to use Heartbleed to get the vital key that essentially unlocks the secure sockets layer padlock in millions of browsers. To be extra-sure, Cloudflare launched ?The Heartbleed Challenge? to see how other people exploiting Heartbleed might fare. The company set up a nginx server running a Heartbleed-vulnerable version of OpenSSL and invited the Internet at large to steal its private key.

Just nine hours later, software engineer Fedor Indutny and Ilkka Mattila at NCSC-FI had obtained the server's private keys using nothing but the Heartbleed vulnerability. As of this writing, CloudFlare had confirmed a total of four winners: Rubin Xu, a PhD student in the Security group of Cambridge University, as well as security researcher Ben Murphy.
Source