SRL Archive - Discussions and Debates

"A group of security researchers uncovered a major vulnerability in the encryption technology used by millions of websites.

Heartbleed is a security flaw discovered by security firm Codenomicon and members of Google Security. It's found in OpenSSL, which is used to protect sensitive data such as emails, passwords or credit card data."

Is SRL vulnerable?

http://heartbleed.com

http://www.usatoday.com/story/tech/2014/04/09/heartbleed-five-questions/7501033/

this is interesting!

SRL? naw.

Villavu looks fine too. It looks like someone took down https - I'm guessing because of this bug. Although something big to note, is that it's entirely possible that a listener was installed between the bug release and before https was taken down. The listener would stay up even after the patch is installed.

There’s already a nice tool to quick check domains for insecurities here: http://filippo.io/Heartbleed/ and if you’re curious for the exact version sites use, you’ll have to go elsewhere.

By SRL I meant villavu, lol. I guess that's why villavu.com returns a refused connection on that tool? This is kind of unsettling. "2/3 of the internet compromised"

From: Clarity
By SRL I meant villavu, lol. I guess that's why villavu.com returns a refused connection on that tool? This is kind of unsettling. "2/3 of the internet compromised"

That quote is horribly incorrect. 2/3 of the public web domains may use SSL, but only something like 20% of that 2/3 uses OpenSSL. OpenSSL is just an OPEN-SOURCE implementation of SSL. There are tons of alternatives that are commonly used outside of OpenSSL.

Ah, glad to hear that. I assumed the news would have a more panic version of the story.

So what now? One of the articles seems to have suggested to not bother changing your passwords until the services have been patched, but how would one know when they have?

Is this normal?

From: BMWxi
So what now? One of the articles seems to have suggested to not bother changing your passwords until the services have been patched, but how would one know when they have?

Right, because any new password would be as retrievable as your old password. Right now what I've done is changed to a random temporary password, with the plan to change to a longterm new password once each service announces a patch.

I assume some kind of announcement would be made, or you could use the tool posted above.

From: Clarity
Right, because any new password would be as retrievable as your old password. Right now what I've done is changed to a random temporary password, with the plan to change to a longterm new password once each service announces a patch.

I assume some kind of announcement would be made, or you could use the tool posted above.

If it's https that is the issue I think what I'll do is clear all chrome's "keep me logged in/autologin" things so that if I want to log in I need to do it manually, and then just not log in anywhere that requires https until the issues have been resolved.

Also that checker site hasn't successfully checked any runescape url, the blue loading bar is hovering near full but not finishing.

From: BMWxi
If it's https that is the issue I think what I'll do is clear all chrome's "keep me logged in/autologin" things so that if I want to log in I need to do it manually, and then just not log in anywhere that requires https until the issues have been resolved.

Also that checker site hasn't successfully checked any runescape url, the blue loading bar is hovering near full but not finishing.

According to the site I linked, Runescape has either patched, or the app is overloaded, and as other sites are working fine for me, I assume Runescape has patched.

I was under the impression that they had to listen between you and the server for a period of time to get 64kb of data which may or may not contain the private key, is this not correct?

Somebody in my class showed an exploit in adf.ly He gathered some sessions id's or something.

I'd be more worried about emails, Paypal (and other online money-handlers), online banking. If someone even had a good enough motive to do this with Villavu, what would they gain?

From: Flight
I'd be more worried about emails, Paypal (and other online money-handlers), online banking. If someone even had a good enough motive to do this with Villavu, what would they gain?

They could promote themself to srl member and leak the like 2 updated scripts that we have

Well I feel like having total admin access is a bit worse than just leaking scripts.

@Flight; is it ok if I borrow your SRL account for a bit? After all, what could I have to gain? :p

From: Clarity
Is SRL[villavu.com] vulnerable?

No, and we were not vulnerable to this bug at any point.

However, several other Runescape botting sites were (and some even continue to be) vulnerable. I suggest you change your passwords if you have any accounts on other sites, especially if you reuse your passwords.

From: BMWxi
@Flight; is it ok if I borrow your SRL account for a bit? After all, what could I have to gain? :p

Sure! Then you could read the discussions on SRL-6 development.

From: Flight
Sure! Then you could read the discussions on SRL-6 development.

And the deep dark secret conversations about ME!
But also like those 2 scripts that have like 4 views each would be a huge leak…

Helpful article describing what passwords you should change: http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/

From: Clarity
Helpful article describing what passwords you should change: http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/

Do you have a list of what sites have updated?

E: Found one myself: http://www.cnet.com/news/which-sites-have-patched-the-heartbleed-bug/

for anyone using LastPass they've made things simple:
(no idea why i have an account on hideMyAss?)