<div dir="ltr">Gidday,<div><br></div><div><br></div><div class="gmail_extra"><div class="gmail_quote">On Thu, Apr 17, 2014 at 3:34 PM, Glen Turner <span dir="ltr"><<a href="mailto:gdt@gdt.id.au" target="_blank">gdt@gdt.id.au</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Brent,<br>
<div class=""><br>
> Up until that point, an exploit had not been posted nor had any proof been made that showed it could be done.<br>
<br>
</div>An attacker didn't need to exploit it. They simply needed to record the contents of the 64KB chunk to take advantage of a future exploit.<br>
<br></blockquote><div><br></div><div>Its probably debatable as to whether a single 64KB chunk would provide anything useful, however, that is why I mentioned the 3 steps to mitigate the risk:</div><div>1. Identify and Patch</div>
<div>2. Replace Certs</div><div>3. Change Passwords</div><div><br></div><div>...you are correct that a future exploit would be theoretically possible if step 2 and 3 were not done.... </div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Also, note that the exploit was to get a private key. There’s plenty of evidence that private information was more easily available.<br>
<br></blockquote><div><br></div><div>In my last post I said that the assumption had to be made that a compromise had already taken place ... well before any of us knew of the issue.</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I view the reluctance of systems administrators to cease serving prior to fixing the bug as simple prioritisation of uptime (ie, revenue) over their user’s privacy.<br></blockquote><div><br></div><div>No....the assumption had to be made that the probability of a compromise was as near as certain as it could be, and, that it had already happened... most likely months before.</div>
<div>A shut down was not going to fix that.... in this instance on the balance of probabilities, an immediate shut down protects nothing and no one. ... there is already blood on the floor so to speak.</div><div><br></div>
<div>Speed in taking those 3 steps is what really matters in terms of user protection.</div><div><br></div><div>And please remember, some SSL enabled systems are not there just to gain "revenue", some drive important infrastructure..</div>
<div><br></div><div>Rgds</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class="HOEnZb"><font color="#888888"><br>
-glen</font></span></blockquote></div><br></div></div>