Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed?


  • 1
    This question is not a duplicate as it addresses a different aspect of the Heartbleed security: Could an attacker gain access to your server after you patched OpenSSL BUT have not yet re-keyed your SSL certs. – Honey Badger Apr 22 '14 at 0:58
  • Or is an attacker limited to man-in-the-middle attack (i.e. by capturing user creds when they login on the sebsite), but not able to access the server itself? – Honey Badger Apr 22 '14 at 1:15

If the remote attacker was able to retrieve you private key before you patched, then they can decrypt all any previous communication that has been performed if you didn't use perfect forward secrecy and perform man-in-the middle attacks. Intercepting and possibly modifying existing communications. They could have also captured credentials needed to remotely access and modify your system, or your user's accounts.

If you are lucky and nobody used this bug to collect your keys or anything else while you were vulnerable, you would theoretically be fine.

  • Thanks for your answer Zoredache. Could you please explain what you mean by "They could have also captured credentials needed to remotely access and modify your system". You mean they could access my server the way one has access using SSH? Or do you mean they could login as admin on a website and have access to only the website files? – Honey Badger Apr 22 '14 at 0:28
  • 1
    Anything that could potentially be in the process memory linking to OpenSSL could have been leaked. This may include your admin credentials, it may include many other things. – Zoredache Apr 22 '14 at 0:35
  • But what if the server's OpenSSL has been patched, but ONLY the SSL cert not rekeyed? Could they still gain access to the server? That's why this question is different to the one quoted as possible duplicate, in that there is only one vulnerability (the old SSL keys, not OpenSSL). – Honey Badger Apr 22 '14 at 0:50
  • 1
    @Honey Heartbleed doesn't allow direct access to control the system, it "bleeds" out information contained within the affected system. The attacker doesn't gain access to your system through the bug itself. Rather they are able to read information that could allow them to gain access to your system, or other sensitive information. Anything that's in your server's RAM. That could be credentials, keys, bank account numbers, anything. So, if keys are one thing that gets out then your encryption is toast (for example). – squillman Apr 22 '14 at 2:47
  • 2
    @Honey Yes, it does. That's why this one's so bad. – squillman Apr 22 '14 at 3:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.