Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I have a web-server, (complete with user account and payment system), that was vulnerable to the Heartbleed attack.

What I'm wondering is:

  • How can I detect if my server has been compromised?
  • How do I recover from a heartbleed attack?
  • How do I ensure the safety of my users data?
share|improve this question

marked as duplicate by Michael Hampton Apr 9 at 22:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

up vote 3 down vote accepted
  • Due to the nature of the heartbleed attack, there is no way to verify that your system has been compromised. Because of this reason, all System and network administrators are encouraged to assume you have been compromised.
  • To recover, first you need to update your openssl version to the latest fix published (this varies depending on your system, for example on redhat it's simply yum update openssl and then restarting all services that use openssl), you need to revoke all past ssl certificates and generate/obtain new ones, change all passwords (usernames wouldn't hurt either).
  • Once the past two things have been done/dealt with, your information should be secure against this bug.

see /this website for more info.

share|improve this answer

Unfortunately, you can't detect whether or not your server has been compromised. Exploitation leaves no record in any logs. Upgrade OpenSSL, renew your SSL certificates, and change all passwords.

share|improve this answer
    
Certainly any HTTPS session which was alive at the time of a heartbleed 'leak' could be proactively and retroactively compromised, and any future sessions would be subject to man-in-the-middle attacks. What about HTTPS: sessions which occurred long enough before a 'leak' that any session-specific memory contents had been overwritten? Would capture of a server's private key information allow retrospective decryption of captured data? –  supercat Apr 14 at 16:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.