By exploiting this vulnerability an intruder is able to view up to 64kb of data in memory, potentially revealing the site's SSL private key and other confidential information such as login names and passwords. This vulnerability is particularly dangerous as it has existed for the past 2 years and it is almost certain that those with nefarious intentions have been exploiting the vulnerability for quite some time. This means that all login names, passwords, and SSL keys on affected systems must be considered compromised.
Black Lotus recommends that system administrators take the following course of action:
- Ensure that web servers are not running a vulnerable OpenSSL implementation.
- In the event that the server was ever running a vulnerable OpenSSL implementation, contact the SSL certificate authority for any keys which may have been compromised and request revocation of the certificate. A new SSL certificate based on a new CSR will be required.
- To be certain, test your site using this tool.- Regardless of the outcome of the aforementioned test, change all passwords, continue to do so frequently and do not use common passwords across multiple sites.
- In the event that the server was ever running a vulnerable OpenSSL implementation, contact the SSL certificate authority for any keys which may have been compromised and request revocation of the certificate. A new SSL certificate based on a new CSR will be required.
- To be certain, test your site using this tool.- Regardless of the outcome of the aforementioned test, change all passwords, continue to do so frequently and do not use common passwords across multiple sites.
Black Lotus is proactively responding to this threat by testing internal systems and those of managed clients. We have confirmed that no Black Lotus systems have been impacted by this vulnerability and no confidential information such as customer login credentials have been compromised. Regardless, we encourage customers to use the aforementioned tool to test for this vulnerability. In the event that a web server is deemed vulnerable it is important to inspect not only the origin web server but also any proxy, such as a DDoS protection service, that may be handling traffic for the site as an OpenSSL implementation on either could result in a leak.
If you have any concerns about the security of your Black Lotus server or DDoS protection service please contact support@blacklotus.net for immediate remediation assistance.
