death bell 2 fragman / Road Tripping the USA Page 69 - OceanZen Bikini

Death Bell 2 Fragman

death bell 2 fragman

OpenSSL CVE-2014-0160 Heartbleed 嚴重漏洞


OpenSSL 今天公告了一個極度嚴重的漏洞(CVE-2014-0160),被稱為「Heartbleed」,而他確實也如同心臟噴出血般嚴重。這個漏洞能讓攻擊者從伺服器記憶體中讀取 64 KB 的資料,利用傳送 heartbeat 的封包給伺服器,在封包中控制變數導致 memcpy 函數複製錯誤的記憶體資料,因而擷取記憶體中可能存在的機敏資料。記憶體中最嚴重可能包含 ssl private key、session cookie、使用者密碼等,因此可能因為這樣的漏洞導致伺服器遭到入侵或取得使用者帳號。詳細的分析可以參閱 existential type crisis : Diagnosis of the OpenSSL Heartbleed Bug
  • 軟體名稱:OpenSSL
  • 影響範圍:1.0.1 至 1.0.1f / 1.0.2-beta ~ 1.0.2-beta1
  • 修復版本:1.0.1g / 1.0.2-beta2
  • 影響系統版本
    • Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
    • Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
    • CentOS 6.5, OpenSSL 1.0.1e-15
    • Fedora 18, OpenSSL 1.0.1e-4
    • OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
    • FreeBSD 10.0 – OpenSSL 1.0.1e 11 Feb 2013
    • NetBSD 5.0.2 (OpenSSL 1.0.1e)
    • OpenSUSE 12.2 (OpenSSL 1.0.1c)
  • 影響服務:HTTP、SMTPS、IMAPS、POP3S 等使用 OpenSSL 之服務

OpenSSL 的公告如下:https://www.openssl.org/news/secadv_20140407.txt

A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1.

如何自我檢測?

要如何測試自己的網站有沒有這樣的漏洞呢?可以利用以下的網站或工具直接查詢。

直接輸入 Domain 即可查詢,例如「fbi.gov」。

OpenSSL CVE-2014-0160 Heartbleed 檢測: fbi.gov

使用方法直接執行「python ssltest.py ifttt.com」,或是用「-p」指定特定 SSL 連接埠。畫面上會顯示出記憶體資料,可能內含機敏資料例如 private key、session cookie 等。

OpenSSL CVE-2014-0160 Heartbleed 檢測: ifttt.com

原始碼如下:

使用方法直接執行「perl check-ssl-heartbleed.pl mail.XXXXXX.gov.tw:443」,可在網域名稱後指定特定 SSL 連接埠。

使用說明:

應對措施

如果發現自己的伺服器有這樣的漏洞,該怎麼辦呢?

  1. 確認自己的 OpenSSL 版本是否在受害範圍
  2. 使用 ssltest.py 檢測工具檢測是否含有漏洞
  3. 更新 OpenSSL 至 1.0.1g 或 1.0.2-beta2
  4. 重開所有與 OpenSSL 函式庫相關之服務
  5. 重新產生 SSL Private Key (因為 Private Key 可能藉由漏洞外洩)
  6. 將網站舊憑證撤銷
  7. 清除所有目前網頁伺服器上的 Session (因為可能遭到竊取)
  8. 必要時更換網站內使用者密碼,或是密切追蹤網站是否有帳號盜用的情況發生

詳細討論與建議可以參考
Heartbleed: What is it and what are options to mitigate it? http://serverfault.com/questions/587329/heartbleed-what-is-it-and-what-are-options-to-mitigate-it

誰會是目標呢?

真的會有攻擊者利用這樣的攻擊手法嗎?目前在烏雲 wooyun平台上已經滿滿的資安研究員開始回報網站含有 OpenSSL 漏洞。也有駭客在嘗試撰寫更有效的攻擊利用程式,想要藉此把平常打不下來的網站一舉攻陷。

怎樣的站台會是重點目標呢?含有會員機制的網站特別如此,例如 Web Mail、社群網站等等。因此不少企業要多注意了,例如全世界最大的社群網站 Facebook、SlideShare、台灣知名電信公司網站、社交平台、網路銀行、NAS,都會在這波的攻擊範圍之內。如果沒有儘速修復,等到更有效的攻擊程式出現,就真的等著失血了。

2018-06-11

技術發布

SUP Pup! Tips for paddle boarding with your dog

June 19, 201820585 Comments

I love my dogs.  I love paddle boarding.  Combining the two is like a Reese's Peanut Butter Cup:  Better than its separate parts.  It wasn't always that way, but after a little bit of dog training and trail and error, it's a thing of great enjoyment for me.  Here's some tips to help shortcut finding SUP Pup zen:

  • Always Make Your Dog Wear A Dog Life Jacket

    Most dogs are great swimmers but there's a few reasons behind my recommendation:
    • Getting your dog from the water and onto your SUP can sometimes be a challenge as SUPs can be slippery.  That large handle on the back of the jacket is a life saver.
    • Even dogs that are excellent swimmers can occasionally tire before reaching shore or your paddle board.  When they have a lifejacket on they become more relaxed and can stay afloat should they fizzle out before reaching you.  Always better to be safe than sorry.
    • Lifejackets are typically bright colors making it easier for you and other boaters to see your pup while in the water
    • Many parks require dogs to be on leashes even while in the water.  Attaching the leash to the lifejacket instead of their normal collar is much safer should it get caught on something.
  • Wear Them Out First

    Get your dog a little tired before going paddle boarding.  Excited dogs on paddle boards equal you in the water.  Bring a water toy to play with for a few minutes before beginning your journey to get some of that restless energy out.  Your pup will be more likely to sit or lay on the board which makes the trip more enjoyable for you and him.
  • Give Them Something To Grip

    Make sure your board has a non-slip pad for your dog's claws and feet to grab onto.  SUPs are notoriously slippery.  Especially composite boards so either buy one with a good non-slip surface or install an aftermarket pad or bungie an old carpet or rubber shower mat to the surface.
  • Trim Nails

    Trim their nails before heading out so they don't scratch up your board when trying to get on.
  • Dog Leash - Yes.  Your Leash - Maybe  

    As previously stated many parks require dogs to be on leashes at all times.  It's also recommended that when paddling a SUP on a lake to wear an ankle or calf leash yourself to keep your board close to you should you fall off.  These two concepts can be at odds with one another as these leashes can get tangled causing a dangerous situation.  If it's windy out where there's a greater chance my board would blow away should I fall, I'll use my leash.  If it's calm, I leave it int the car.  Use your best judgement.  Remember to never tie your dog's leash to anything.  I recommend standing on it while you paddle making it easy to release should a need arise.
  • Bring water and a water bowl 

    You and your dog will get thirsty and lake water isn't always something you want your dog drinking.  As a result, bring some water and preferably a bowl that floats.
  • Anticipate The Jump

    Go down to your knees whenever you near shore or other dogs are present.  Dogs get excited and will often jump off your board as you near shore.  If you don't want to go sailing should this occur, I'd get to a good stable knee position before they get too excited
  • Practice With Your Dog

    Like other dog training a little training goes a long way.  Start on shore and get your dog to be comfortable standing on the board.  Gradually move to the water and get your dog comfortable on the board with you standing in shallow water next to it.  Progress onto having him climb on with you kneeling on the board and eventually stand and begin paddling.  Work diligently on teaching him to stay until you give a release command to minimize unexpected jumping off.  If you're dog trains best with treats, make sure you bring some that can get wet along.

I hope these tips encourage you to bring your dog paddle boarding and give you the knowledge to get up and paddling quickly.  Your dogs will love it.  I know my two Aussies do!

What tips do you have?



100 Responses

Leave a comment

nest...

batman iftar saati 2021 viranşehir kaç kilometre seferberlik ne demek namaz nasıl kılınır ve hangi dualar okunur özel jimer anlamlı bayram mesajı maxoak 50.000 mah powerbank cin tırnağı nedir