8 Apr
2014
8 Apr
'14
6:21 p.m.
Hello,
If you've been reading tech news in the last 24 hours then you're
probably aware of "heartbleed", but if not then you will want to
have a read of:
http://heartbleed.com/
and take appropriate action.
If you trust this site you can use it to check if your HTTPS server
is vulnerable or not:
http://filippo.io/Heartbleed/
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
10 Apr
10 Apr
9:24 a.m.
New subject: Regarding possible exposure of your BitFolk account credentials via the "heartbleed" vulnerability
On Tue, Apr 08, 2014 at 06:21:58PM +0000, Andy Smith wrote:
If you've been reading tech news in the last 24
hours then you're
probably aware of "heartbleed", but if not then you will want to
have a read of:
http://heartbleed.com/
and take appropriate action.
Some information about the possible exposure of your BitFolk
credentials to this bug:
- https://tools.bitfolk.com/… (wiki, feature tracker, cacti)
Hosts terminating these SSL sessions were upgraded to Debian
wheezy on September 22nd 2013 so there was therefore a window
between then and Tuesday 8th April 2014 during which the
vulnerable versions of OpenSSL were being run.
An attacker with knowledge of the bug could conceivably have
abused it to read server memory, which could possibly have
contained your BitFolk credentials.
The likelihood of someone who was already aware of this bug using
it to steal credentials of BitFolk customers from our wiki /
tracker / cacti sites inside the 6.5 month window seem very low,
but if you think you have logged in to any of those sites since
last September then you may wish to change your passwords as a
precaution.
You can change your password via:
https://panel.bitfolk.com/account/security/
The SSL cert has since been replaced.
- https://bitfolk.com/
https://panel.bitfolk.com/
https://nagios.bitfolk.com/nagios/
These sites have never run vulnerable versions of the OpenSSL libraries.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
6:31 p.m.
New subject: Scanning for "heartbleed" vulnerability
Hi,
We're going to do some scans of our IPv4 space to look for services
vulnerable to the OpenSSL "heartbleed" vulnerability, so we can open
tickets with customers about it¹.
I am warning you in case you have firewalls / IDS mechanisms that
may panic on seeing someone try to make use of it.
The scans will come from 173.255.227.192 and 88.198.54.123 and will
not cause any damage.
Cheers,
Andy
¹ ("Reasonable effort" courtesy free service, no contact doesn't
mean we are certifying you as safe, conditions apply, your
causality is at risk if you misappropriate entropy, etc. etc.)
--
http://bitfolk.com/ -- No-nonsense VPS hosting
11 Apr
11 Apr
6:54 p.m.
New subject: [bitfolk] Scanning for "heartbleed" vulnerability
On Thu, Apr 10, 2014 at 06:31:42PM +0000, Andy Smith wrote:
We're going to do some scans of our IPv4 space to
look for services
vulnerable to the OpenSSL "heartbleed" vulnerability, so we can open
tickets with customers about it¹.
The first round of these tickets has now been created, so if you
didn't get one that means:
- Congratulations, you weren't vulnerable! Or;
- We missed something, or;
- Our email (from support(a)bitfolk.com) went into your spam folder
At the moment we are only checking ports: 25, 443, 465, 587, 993,
995, 8443. Can you think of any others that are likely to have SSL
services on?
I'll save further discussion for the users list from now on.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
3685
days inactive
3688
days old
3 comments
1 participants
participants (1)
-
Andy Smith