From: Dave Taht <dave.taht@gmail.com>
To: "cerowrt-devel@lists.bufferbloat.net"
<cerowrt-devel@lists.bufferbloat.net>
Subject: [Cerowrt-devel] Fwd: [uknof] CVE-2014-0160 mitigation using iptables
Date: Wed, 9 Apr 2014 08:18:23 -0700 [thread overview]
Message-ID: <CAA93jw4YRcfmvrMzijGhDLr+A=CYO2i3Bqq8uATLka=Bgj_xHQ@mail.gmail.com> (raw)
In-Reply-To: <53453B13.8000705@ecsc.co.uk>
It is not clear if this could be used to protect things inside the
firewall (switching to a forward rather than input table), nor if it
could be used with ipv6.
---------- Forwarded message ----------
From: Fabien Bourdaire <lists@ecsc.co.uk>
Date: Wed, Apr 9, 2014 at 5:20 AM
Subject: [uknof] CVE-2014-0160 mitigation using iptables
To: uknof@lists.uknof.org.uk
Following up on the CVE-2014-0160 vulnerability, heartbleed. We've
created some iptables rules to block all heartbeat queries using the
very powerful u32 module.
The rules allow you to mitigate systems that can't yet be patched by
blocking ALL the heartbeat handshakes. We also like the capability to
log external scanners :)
The rules have been specifically created for HTTPS traffic and may be
adapted for other protocols; SMTPS/IMAPS/...
# Log rules
iptables -t filter -A INPUT -p tcp --dport 443 -m u32 --u32 \
"52=0x18030000:0x1803FFFF" -j LOG --log-prefix "BLOCKED: HEARTBEAT"
# Block rules
iptables -t filter -A INPUT -p tcp --dport 443 -m u32 --u32 \
"52=0x18030000:0x1803FFFF" -j DROP
# Wireshark rules
$ tshark -i interface port 443 -R 'frame[68:1] == 18'
$ tshark -i interface port 443 -R 'ssl.record.content_type == 24'
We believe that this should only be used as a temporary fix to decrease
the exposure window. The log rule should allow you to test the firewall
rules before being used in production. It goes without saying that if
you have any suggested improvements to these rules we would be grateful
if you could share them with the security community.
Clearly, use of these rules is at your own risk ;)
ECSC SOC Team Researchers:
Adam Shore
Alex Innes
Fabien Bourdaire
--
ECSC Ltd - http://www.ecsc.co.uk
--
Dave Täht
NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article
next parent reply other threads:[~2014-04-09 15:18 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <53453B13.8000705@ecsc.co.uk>
2014-04-09 15:18 ` Dave Taht [this message]
2014-04-09 15:41 ` Valdis.Kletnieks
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.bufferbloat.net/postorius/lists/cerowrt-devel.lists.bufferbloat.net/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAA93jw4YRcfmvrMzijGhDLr+A=CYO2i3Bqq8uATLka=Bgj_xHQ@mail.gmail.com' \
--to=dave.taht@gmail.com \
--cc=cerowrt-devel@lists.bufferbloat.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox