Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed?


share|improve this question

marked as duplicate by Zoredache, EEAA, Wesley, Nathan C, Ward Apr 22 '14 at 2:18

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

This question is not a duplicate as it addresses a different aspect of the Heartbleed security: Could an attacker gain access to your server after you patched OpenSSL BUT have not yet re-keyed your SSL certs. – Honey Badger Apr 22 '14 at 0:58
Or is an attacker limited to man-in-the-middle attack (i.e. by capturing user creds when they login on the sebsite), but not able to access the server itself? – Honey Badger Apr 22 '14 at 1:15
up vote 5 down vote accepted

If the remote attacker was able to retrieve you private key before you patched, then they can decrypt all any previous communication that has been performed if you didn't use perfect forward secrecy and perform man-in-the middle attacks. Intercepting and possibly modifying existing communications. They could have also captured credentials needed to remotely access and modify your system, or your user's accounts.

If you are lucky and nobody used this bug to collect your keys or anything else while you were vulnerable, you would theoretically be fine.

share|improve this answer
Thanks for your answer Zoredache. Could you please explain what you mean by "They could have also captured credentials needed to remotely access and modify your system". You mean they could access my server the way one has access using SSH? Or do you mean they could login as admin on a website and have access to only the website files? – Honey Badger Apr 22 '14 at 0:28
Anything that could potentially be in the process memory linking to OpenSSL could have been leaked. This may include your admin credentials, it may include many other things. – Zoredache Apr 22 '14 at 0:35
But what if the server's OpenSSL has been patched, but ONLY the SSL cert not rekeyed? Could they still gain access to the server? That's why this question is different to the one quoted as possible duplicate, in that there is only one vulnerability (the old SSL keys, not OpenSSL). – Honey Badger Apr 22 '14 at 0:50
@Honey Heartbleed doesn't allow direct access to control the system, it "bleeds" out information contained within the affected system. The attacker doesn't gain access to your system through the bug itself. Rather they are able to read information that could allow them to gain access to your system, or other sensitive information. Anything that's in your server's RAM. That could be credentials, keys, bank account numbers, anything. So, if keys are one thing that gets out then your encryption is toast (for example). – squillman Apr 22 '14 at 2:47
@Honey Yes, it does. That's why this one's so bad. – squillman Apr 22 '14 at 3:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.