14

With all the chatter going on about the heartbleed bug, it's hard to find information on what exactly the exploited heartbeat extension for OpenSSL is used for.

Also, is it possible to disable it for Apache w/ mod_ssl without recompling with the -DOPENSSL_NO_HEARTBEATS flag as suggested @ http://heartbleed.com/?

user193130
  • 8,009
  • 4
  • 36
  • 64
  • 4
    http://xkcd.com/1354/ – JBentley Apr 11 '14 at 13:47
  • @JBentley Hah that seems to pretty much sum it up, thanks! Makes me wonder though why they don't just enforce a constant size and instead decided to allow the user to specify a size. – user193130 Apr 11 '14 at 15:51
  • Why the user is allowed to specify a size: https://security.stackexchange.com/questions/55606/heartbleed-why-does-the-client-supply-the-length-of-the-message-at-all – user193130 Apr 17 '14 at 20:35

3 Answers3

13

Heartbeat is an echo functionality where either side (client or server) requests that a number of bytes of data that it sends to the other side be echoed back. The idea appears to be that this can be used as a keep-alive feature, with the echo functionality presumably meant to allow verifying that both ends continue to correctly handle encryption and decryption. The problem, of course, is that until the recent patch, OpenSSL did not guard against sending back more data than was provided in the first place. I'm not really aware of where the heartbeat extension is actually used in an application since most communication that requires it (e.g. websockets) rely on their own keep-alive features implemented on a higher level.

I can't answer your second question---but it would surprise me if the answer was yes.

  • pyramids is there any way to contact you privately? – schone Aug 01 '16 at 19:16
  • @schone No, I guess there is no way to contact me privately on here (I don't want to post my contact details publicly and the site doesn't want to implement private messaging, see [this answer](http://meta.stackexchange.com/a/57538)). I'd be happy to ask you what it is about, though, if there is a way to contact you...? –  Aug 02 '16 at 08:11
  • yeah try me on twitter with the same handle, it's about an old post of yours that I wanted to ask if you're still interested in – schone Aug 02 '16 at 17:31
  • @pyramids I'm trying to contact you as well, likely about the same post. Could you reach out to me via e-mail at jd (dot) dallago (at) gmail (dot) com? Or on Twitter @_jayd3e. I could give you more info there. – JayD3e Aug 17 '17 at 23:33
4

Try this for info on heart beats: http://www.troyhunt.com/2014/04/everything-you-need-to-know-about.html

I'm not really an apache guy, I gather that the flag works but that there may be a performance hit. The advice is to recompile. Also talk to your devs about sending emails, you may want to consider asking your users to change their passwords - just to be on the safe side. I've had a couple of services email like that already

LightningShield
  • 680
  • 3
  • 13
4

You can find all the details on the TLS and the DTLS Heartbeat extension by reading RFC6520: https://www.rfc-editor.org/rfc/rfc6520.

Community
  • 1
  • 1
Arturo Filastò - hellais
  • 201
  • 2
  • 9