SSL vulnerability

[sidd]

I am sure the administrators have fixed this ? But it would be nice to have an assurance. Logs should show if it was exploited, perhaps ?

sidd

[DungeonMaster]

Hi Sidd 

I spent the night verifying all the servers I administer, a fixing a couple of them. The forum is NOT affected and NEVER was - so no information leaked from here. I issued the News on the forum before actually reading your message

Unfortunately this bug leaves no trace in any log... It's not even sure yet if special systems Intrusion Detection Systems (IDS) can be tuned to catch this... So the big problem is that nobody knows if this vuln was exploited and if bank, e-commerce... servers were under attack.

I you use the same password in many places : change it here safely now, on other places when they're fixed.

You can check if a server is safe on http://filippo.io/Heartbleed/ (if that server doesn't melt under queries !). If the sites you use are not safe yet, try not to log in until they're fixed; then change your password.

http://heartbleed.com/ has a very good reference.

[wili]

I'm probably the only one that needs to ask this dumb of a question, but what are the exact steps I need to take to change my password on this forum? Thanks ahead of time for any directions, and for all your work.

[sidd]

I believe that there are some log traces that can be used, i seem to recall something on schneier's blog about it. But if you did not use the vulnerable versions, you are ok.

Note: this vulnerability can be reversed by malicious servers to attack vulnerable clients also ...

sidd