&yet

So Heartbleed happened, and if you’re a company or individual who has public facing assets that are behind anything using OpenSSL, you need to respond to this now.

The first thing we had to do at &yet was determine what was actually impacted by this disclosure. We had to make list of what services are public facing, which services use OpenSSL directly or indirectly, and which services use keys/tokens that are cryptographically generated. It’s easy to only update your web servers, but really that is just one of many steps.

Here is a list of what you can do to respond to this event.

1. Upgrade your servers to have the most recent version of OpenSSL, specifically version v1.0.1g, installed. The list of OS packages which have that version are too numerous to list so double check with your package manager for what version is appropriate.

2. Restart any instance of Nginx, Apache, HAproxy, Varnish, XMPP Server or any other tool that dynamically links to OpenSSL.

3. For any public facing service you are running that statically links to OpenSSL (or one of its libraries) you will need to rebuild the code and deploy. For us that was “restund” which we use for STUN/TURN.

4. For any authentication database you have that uses OAuth tokens or cryptographically generated keys, you should mark all of those tokens and keys as invalid and force them to be regenerated.

5. Any public facing SSL Certificate you have should be revoked and new certificates with new keys generated as well.

The last two items can be somewhat daunting, since due to the nature of this exploit we don’t know if our certs or keys (or really anything in memory) were compromised. The responsible thing to do is to assume that they were compromised, and replace them.

Security Bulletins:

• Mitre CVE for Heartbleed CVE-2014-0160
• OpenSSL Security Advisory 20140407
• Ubuntu Security Notice USN-2165-1
• RedHat Security Advisory RHSA-2014:0376-1
• Fedora Project Announcment
• CentOS Announcement
• Debian Security Tracker

Resources:

• OpenSSL Git Commit for CVE-2014-0160
• NGINX and the Heartbleed vulnerability
• serverfault: My server is still vulnerable to heartbleed even after I update OpenSSL
• RedHat Support Article for OpenSSL CVE-2014-0160
• RedHat Security Response Bug

You might also enjoy reading:

• Introducing Facecamp: Chat your mug!
• The official title of this post is “Lift off” (in honor of how good NLF’s puns are), but just to be clear, it’s about the fact that npm acquired ^lift and nsp
• It's our Birthday!
• Talky gets Real-time Text
• Talky for smaller screens