Third Party Security Vulnerabilities - How Late is Too Late?

By now, I'm sure you've heard about the nightmare that is the Heartbleed bug.

One of the biggest problems with this bug is that OpenSSL is integrated into a lot of software, which means not only do you need to update any copies of OpenSSL, but you need to update software products which use OpenSSL.

Almost three weeks have gone by, and we're still seeing companies releasing updates to address this critical vulnerability.

This means for three weeks after public disclosure, products have been vulnerable without any means of fixing the problem.

Is it time to re-evaluate what is an acceptable time period for a company to release a security update to third party libraries?

Late Night Coffee with Caffeine Security - 4/18/2014

I'm happy to announce that my first episode of "Late Night Coffee" was a success.

In case you missed it, here's what was discussed.

Topics include:

• Heartbleed
• Critical Infrastructure Cyber Security Framework
• News of the World Phone Hacking Scandal
• Windows XP End of Life
• Michaels Data Breach
• Additional late-breaking security news

Listen to the show below! Did you like the show? Do you think I should make it a regular event? Let me know in the comments section below!

Late Night Coffee with Caffeine Security - Week in Brief 04/18 by CaffSec | Technology Podcasts

After much debate, I've decided to host this Friday my very first online radio show!



Topics include:

• Heartbleed
• Critical Infrastructure Cyber Security Framework
• News of the World Phone Hacking Scandal
• Additional late-breaking security news

Don't miss it, this Friday, 4/18, at 11 PM EDT!



Late Night Coffee with Caffeine Security - Week in Brief 04/18 by CaffSec | Technology Podcasts

Heartbleed: How it was introduced, How it was fixed, and What's Vulnerable?

The Register has an excellent writeup on how Heartbleed was introduced into OpenSSL.

After doing some digging on OpenSSL's GIT repository, I was able to identify the commits which introduced, as well as fixed, this bug.

The bug was originally introduced into OpenSSL's source code on Dec 31, 2011.  According to the diff, the heartbeat code was provided by Robin Seggelmann. Robin has already stated that the error was "trivial", but clearly the error had far-reaching consequences.

The bug was fixed with only a few lines of code, as you can see from this commit from April 5, 2014.

On a side note, Robin was also one of the contributors to RFC 6520, which described the TLS heartbeat extension.

If you'd like to see the Heartbleed vulnerability status of popular websites, visit the Github page which is tracking the status of Heartbleed patching.