So I didn't get much done this weekend. I'd planned to finally finish reorganizing my dotfiles repo, and instead I spent about six hours changing passwords because of this Heartbleed thing. If you haven't heard about it yet, you will, it's the OpenSSL bug that came out publicly on Monday, and by Tuesday every security mailing list I'm on had turned into a slow-motion panic.
The short version, since half the coverage out there is either too technical or too vague to be useful: OpenSSL is the library a huge chunk of the internet uses to do HTTPS encryption, and it turns out for about two years there's been a bug in its "heartbeat" feature that lets an attacker ask a server for a chunk of its memory, up to 64 kilobytes at a time, with basically no trace left behind. That memory can contain usernames, passwords, session cookies, even the server's private encryption keys. Two years. Nobody knew. That's the part that got me, honestly, not that a bug existed, bugs always exist, but that it was just sitting there quietly leakable since like 2012.
Here's what I actually did, in case anyone wants the practical version instead of another "this is bad" post, because god knows there are enough of those already:
First, I checked which sites were even vulnerable before rage-changing forty passwords for no reason. There's a tool a guy named Filippo Valsorda threw together at filippo.io/Heartbleed that you point at any domain and it tells you if the server's still exposed. LastPass has one built into their security check tool too if you're already a customer. I ran it against maybe fifteen sites I actually care about. Some were fine, apparently Google's stuff wasn't affected, and neither was Amazon, at least not on the properties I checked. A few were still very much open when I tested them Monday night.
Second, and this is the part everyone keeps forgetting to mention, changing your password before a site patches its server does basically nothing. If they're still running vulnerable OpenSSL, your shiny new password just goes into the same leaky memory the old one was in. You have to wait until the site actually patches and, ideally, until they've reissued their SSL certificate, because if an attacker grabbed the private key at some point in the last two years the certificate itself is compromised and rotating your password doesn't fix that. This is the annoying part. You basically have to sit around refreshing a checker tool waiting for some ops team you've never met to get around to it.
Third, I finally set up two-factor auth on the handful of accounts I'd been putting off for embarrassingly long. Email, obviously. My domain registrar. I'd been lazy about this for maybe a year and a half and kept telling myself I'd do it "eventually." Turns out "eventually" is whenever a headline scares you enough.
I'll admit my own security hygiene going into this was pretty mediocre, I had maybe four passwords in rotation across something like thirty accounts, which is exactly the kind of thing I'd have judged someone else for. I've been using 1Password for the important stuff for a while now but never bothered migrating the long tail of forums and random sign-ups, and this was the kick I needed.
One small silver lining, if there is one: this happened to land the same week Microsoft officially cut off support for Windows XP, which meant I was already knee-deep in "old software finally catching up with reality" territory. Between the two, it's been a rough week for anyone still running anything from the Bush administration.
If you run your own server with OpenSSL — and a lot of people reading a blog like this probably do, even just a little VPS somewhere — go check your version right now. You want 1.0.1g or later, or a version with heartbeats compiled out. It takes five minutes and it's a lot better than finding out some other way.
I'm not going to pretend I have some grand takeaway here. Mostly I'm just annoyed I lost a Saturday to this, and a little rattled that "two years, nobody noticed" is apparently just how the internet works sometimes.