Heartbleed - Open SSL vulnerability

[letmeoutpax]

Apparently a big deal. Are passwords used on mdshooters ok?

Thanks,
Matt

 

[elwojo]

I have always assumed everything on here was likely to be compromised due to a lack of an up-to-date security certificate (and not honestly because of malicious anti-gunners). I do not know how much of the traffic here is encrypted either - but given the state of an out-of-date certificate, my hopes are not riding too high.

When testing for the vulnerability, the automated test I have used to verify other websites compliance draws a null on mdshooters.

 

[wrc]

Currently safe from "heartbleed"

www.mdshooters.com does not respond to the vulnerable protocol component, so at this point in time it is not vulnerable. If this is because an in-line security device is mitigating the problem, it could have been vulnerable in the past.

However, when you log into mdshooters.com, you are doing it over an unencrypted channel, so anyone able to see your network traffic can easily intercept your credentials.

That's not great news, but it does mean that someone needs to capture your traffic -- they need to watch a network between MDS and your client. The "heartbleed" vulnerability would expose your credentials (randomly) to anyone anywhere who can talk to the vulnerable host.

The takeaway here is absolutely do not use the password you use on here anywhere else, especially if you use things like "free wifi" without protection.

 

[letmeoutpax]

Great info, thanks a lot. One more question: when some application or website asks to save a password or keep you logged in, does that create a vulnerability?

 

[Mooseman]

I am not a computer guy but I heard that the risk of Heartbleed is being blown out of proportion.

 

[Skins_Brew]

I have always assumed everything on here was likely to be compromised due to a lack of an up-to-date security certificate (and not honestly because of malicious anti-gunners). I do not know how much of the traffic here is encrypted either - but given the state of an out-of-date certificate, my hopes are not riding too high.

When testing for the vulnerability, the automated test I have used to verify other websites compliance draws a null on mdshooters.

The cert should be up to date, but even though it is expired, when you use the https site, your connection to the server is encrypted and secure.

 

[Skins_Brew]

www.mdshooters.com does not respond to the vulnerable protocol component, so at this point in time it is not vulnerable. If this is because an in-line security device is mitigating the problem, it could have been vulnerable in the past.

However, when you log into mdshooters.com, you are doing it over an unencrypted channel, so anyone able to see your network traffic can easily intercept your credentials.

That's not great news, but it does mean that someone needs to capture your traffic -- they need to watch a network between MDS and your client. The "heartbleed" vulnerability would expose your credentials (randomly) to anyone anywhere who can talk to the vulnerable host.

The takeaway here is absolutely do not use the password you use on here anywhere else, especially if you use things like "free wifi" without protection.

I captured my login once and it seems like the browser hashes the password before it gets sent to the server.

 

[gmhowell]

I am not a computer guy but I heard that the risk of Heartbleed is being blown out of proportion.

Maybe. The trick is how long have the bad guys known? If this exploit has been out there for a while it's not good. If they didn't know until last week, it's better.

The alarm bells are warranted. If there turns out to be no or few exploits, it is because the response has been so loud and fast. If people ignored it, many people would have many problems.


Sent from my iPhone using Tapatalk

 

[wrc]

I captured my login once and it seems like the browser hashes the password before it gets sent to the server.

It does, using /clientscript/vbulletin_md5.js in the login process. You have to use an uncommonly long and complicated password or that's not much of a hurdle. If you stay logged in, your bbpassword cookie is useful to an attacker who wants to impersonate you on this site.

 

[Boondock Saint]

The vulnerability explained by xkcd:

 

[Traveler]

I am not a computer guy but I heard that the risk of Heartbleed is being blown out of proportion.

You heard wrong. I have been an IT guy for over 25 years. Change your passwords, make them long and complicated, use a password vault, no two sites should have the same password.

http://sourceforge.net/projects/keepass/

 

[Boondock Saint]

KeePass is good stuff. I use it every day.

For those not inclined to go that far, I have yet another xkcd comic for you.

 

[wrc]

A pretty good list of popular sites that you should change your passwords on first.

 

[rambling_one]

I was able to change my MDS password using the home computer, but can't get the iPhone to remember it. Every time I log via the phone the old PW appears and I have to manually type over it. Any suggestions?

 

[rambling_one]

I was able to change my MDS password using the home computer, but can't get the iPhone to remember it. Every time I log via the phone the old PW appears and I have to manually type over it. Any suggestions?

Bump.

Problem still unresolved. Perhaps my best best if to go back to Verizon and see if their "experts" can help me <g>.

 

[Minuteman]

Bump.

Problem still unresolved. Perhaps my best best if to go back to Verizon and see if their "experts" can help me <g>.

My apologies, I have not read this thread.

My very simple advice, for what it's worth:

Do not use Internet Explorer as your web browser until they get it fixed. Currently it is totally open to criminals....

At this moment, I'm going to recommend Firefox. for now.

Here's an old video that many will find informative and entertaining.

 

[tsmith1499]

Firefox is all I have used at work and home for about a year now. Explorer is too slow and too many issues.

 

[Minuteman]

What are those creatures at 4:38 in the video I pasted above?