Hacker News Reader

Comment by Pxtl | Hacker News Reader

I'm confused how openSSL on Android is a problem... isn't openSSL a server technology? Do the clients use a heartbeat for something?

Or is this only relevant when you're running a server on your client device?

Is OpenSSL always running as a server on Android?

View on HN

Heartbeat goes both ways. If you can be tricked to accessing a malicious HTTPS server, it can extract data from the client. http://blog.meldium.com/home/2014/4/10/testing-for-reverse-h...

... wow, the media firestorm around heartbleed was so fixated on the server-side issue that this completely slipped by me. I guess it's only relevant to one particular Android version and a handful of Linux-based versions where patching is expected to occur automatically and quickly, and nobody cares about desktop Linux.

I wonder how many different ways you can trick a server into accessing a HTTPS site. Seems like lots of services check links in comments or load remote images or run webhooks...

I can definitely see how a server could slip through the cracks if it has a broken HTTPS client, but the site it's serving is fine. No automated scanner is gonna pick that up from the outside.

Android 4.1.1 is the vulnerable version. Google says only 4.1.1 is vulnerable. There are a handful of services on Android that use openssl and, I suppose, could present open ports for there to be an attack vector. See http://www.pcmag.com/article2/0,2817,2456507,00.asp

You can also MITM outgoing SSL connections and use heartbleed on them. The vulnerability is accessible before the certificate checks are completed, so the standard MITM prevention measures don't help you there.

You can check for vulnerable clients using this site https://reverseheartbleed.com/

No, OpenSSL is equally for clients and servers. It's a general purpose crypto library. You can use it in anything to do with crypto.

Reply on news.ycombinator.com