|By Lori MacVittie||
|April 15, 2014 08:00 AM EDT||
There are a variety of opinions on the seriousness of Heartbleed being put forth ranging from "it's not the end of the world" to "the sky is falling, duck and cover." Usually the former cites the relatively low percentage of sites impacted by Heartbleed, pegged at about 17% or 500,000 sites by Netcraft. The latter cite the number of consumers impacted, which is a way bigger number to be sure. Sites tracking the impact to users suggest many of the largest sites have potentially been impacted, translating into many millions of users.
And then there’s the impact on gadgets and devices we might not immediately think of being vulnerable. A wide variety of smart phones, IP phones, switches and routers have been identified as being vulnerable. Home internet routers and that nifty system you had put in that lets you mess with your house’s temperature from any device, anywhere are likely impacted. With the Internet of Things connecting more and more devices it’s likely that list will only continue to grow. The growing consensus is that a plurality of the impacted devices will never be updated; leaving organizations that may interact with those devices vulnerable and in need of a mitigating solution that doesn’t rely on updates or changes to the device.
There will be, as everyone scrambles to protect customers and consumers from Heartbleed, a variety of mitigating solutions offered up to address this pesky bug. Network devices will enable organizations with the visibility necessary to detect and reject requests attempting to exploit the vulnerability.
There are a variety of points within the data path where solutions could be put into place to mitigate this (and similar) vulnerabilities. Thus customers must choose the most strategic point in the network at which to deploy their selected mitigation. To choose that point, organizations should ask how the exploit is detected by given solutions. To see why that's needful, consider how the attack works.
How Heartbleed Works
Heartbleed takes advantage of a missing length check in the OpenSSL code handling a relatively innocuous extension to the TSL/SSL protocol (defined in RFC 6520). It comprises two simple messages: a request and a response. The request can be sent be either the client or the server as a means to keep the connection alive. The sender ships off a HeartbeatMessage with a small amount of data, expecting the receiver to send back that same data. What's important about the protocol interaction is that whichever party sends the request determines the length of the response. The sender tells the receiver how much data it's sending - and thus how much should be returned.
Now, the OpenSSL code should be making sure the length the attacker says he's sending is actually what's available. The code, however, does not. It simply trusts the sender and grabs whatever amount of data was specified out of memory. This is how an attacker can access data that's in memory and wind up with all sorts of sensitive data like passwords and private keys.
Because this exploit takes advantage of a vulnerability in encrypted communications, any mitigating solution must be in the path of that communication. That's a given. In that path are three points where this exploit can be mitigated:
1. Client. You can check the client operating system and device type and match that against known usage of the impacted OpenSSL versions. Once detected, the client can be rejected - preventing the offending request from ever being sent in the first place. Rejection of clients based on the possibility they might be an attacker can result in angry legitimate consumers, employees or partners, however.
2. On Request. Inspect client requests and upon discovery of a HeartbeatMessage, reject it. This prevents the request from being forwarding to vulnerable systems and servers.
3. On Response. Inspect responses and upon seeing a HeartbeatMessage response, check its length. If it's greater than a length you feel comfortable with, discard it. This method will prevent attackers from receiving sensitive data, but it should be noted that at the point of discovery, the server - and data - has already been compromised.
Location in the Network Matters
You have to be in communication path to implement these solutions. That means some solutions being put forth are architecturally misplaced to be able to completely mitigate this vulnerability. For example, the firewall landscape is bifurcating and separating inbound (application delivery) and outbound (next generation firewall) duties. That means while next-generation firewalls (NGFW) are capable of the inspection and interaction necessary to detect and mitigate Heartbleed on response, they generally only do so in the outbound use case. That's an important capability, but it won't catch inbound attempts, just outbound. Further complicating the situation is a growing delineation of security responsibilities between inbound and outbound in the firewall market. Growth and scale of security has led to separate inbound and outbound security solutions. NGFW are an outbound solution, generally positioned only as protection for corporate users. They’re intended to protect organizations from malware and malicious code entering the corporate data center by means of its employees accessing infected sites. They aren’t deployed in a position to protect servers and applications on the inbound path. Those that are can provide inbound protection but only on response, which means your servers have already been compromised.
The right place to implement a mitigating solution is one that will afford you the choice of your mitigating solution - or allow all three, if you really want comprehensive coverage. It must be in the data path and have visibility into both the client and the server side of the equation. In most networks, that strategic point of control is the application delivery firewall.
Using the right tool in the right place in the network means you can implement any (or all) of the three mitigating solutions in not only a one place, but in the most effective place. The right tool is not just one that has the right position in the network. It takes visibility and programmability to dig deeply into the network stack and find the data indicative of an attack – intentional or not. The right tool will be able to distinguish between client side and server side traffic and apply the applicable logic. The logic that detects Heartbleed on the client side is different than that of the server side. In the case of the client it must look for a specific message indicating a Heartbeat request or inspecting the client device environment itself. On the server side, it’s checking the size of the response. Each of these cases requires unique code. That means the right tool must have a programmatic environment that can execute with surgical-like precision the logic necessary at the right time – at the time of connection, on request and on response.
The right tool, then, is positioned on the inbound path – in front of vulnerable services – and offers an event-driven, programmatic way to execute the right logic at the right time to detect vulnerable clients, malicious requests and responses carrying unauthorized sensitive data. An F5 ADC offers that event-driven, programmatic interface with iRules and is strategically positioned in the network to support all three mitigation solutions.
Consider again how Heartbleed works and the three mitigation options:
(1) Client. In most network architectures this means it is connecting to an application delivery controller (ADC) that provides load balancing services. When that ADC is F5, it also acts as an application delivery firewall (ADF) and can be programmatically controlled. That means it can inspect the request and, if it's vulnerable, reject the connection.
(2) On Request. Because an ADC sits between the client and server and acts as a proxy, it sees every request and response. It can be programmatically instructed using iRules to inspect those requests and, upon finding a Heartbeat request message, can reject it. It is not necessary to decrypt the request to detect the Heartbeat message.
(3) On Response. As noted, the strategic point of control in which an F5 ADC is deployed in the network means it sees every response, too. It can programmatically inspect responses and if found to be over a specified length, discard it to prevent the attacker from getting a hold of sensitive data.
F5 suggests the "On Request" mitigation for dealing with Heartbleed. This approach minimizes the impact to clients and prevents legitimate requests from being rejected, and further assures that servers are not compromised. Customers have the option, of course, to implement any or all three of these options in order to protect their applications, customers and data as they see fit. F5 supports customer choices in every aspect of application delivery whether related to security, orchestration or architectural model.
At this point, nearly a week after the exposure of Heartbleed, organizations should have a good handle on how it works and what the impact is to their business. There's no question the response to Heartbleed involves server patches and upgrades and the procurement of new keys, with consumer password change processes to come soon thereafter.
In the meantime, servers (and thus customers) remain vulnerable. Organizations should be looking at putting into place a mitigation solution to protect both while longer-term plans are put into action.
No matter which approach you choose, F5 has got you covered.
[Edited: 11:11am PT with new graphic]
Developing software for the Internet of Things (IoT) comes with its own set of challenges. Security, privacy, and unified standards are a few key issues. In addition, each IoT product is comprised of (at least) three separate application components: the software embedded in the device, the back-end service, and the mobile application for the end user’s controls. Each component is developed by a different team, using different technologies and practices, and deployed to a different stack/target –...
Aug. 31, 2016 05:15 PM EDT Reads: 258
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devices - comp...
Aug. 31, 2016 04:45 PM EDT Reads: 3,838
SYS-CON Events announced today that Numerex Corp, a leading provider of managed enterprise solutions enabling the Internet of Things (IoT), will exhibit at the 19th International Cloud Expo | @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Numerex Corp. (NASDAQ:NMRX) is a leading provider of managed enterprise solutions enabling the Internet of Things (IoT). The Company's solutions produce new revenue streams or create operating...
Aug. 31, 2016 04:39 PM EDT Reads: 138
As cloud adoption continues to transform business, today’s global enterprises are challenged with managing a growing amount of information living outside of the data center. The rapid adoption of IoT and increasingly mobile workforce are exacerbating the problem. Ensuring secure data sharing and efficient backup poses capacity and bandwidth considerations as well as policy and regulatory compliance issues.
Aug. 31, 2016 03:15 PM EDT Reads: 307
Why do your mobile transformations need to happen today? Mobile is the strategy that enterprise transformation centers on to drive customer engagement. In his general session at @ThingsExpo, Roger Woods, Director, Mobile Product & Strategy – Adobe Marketing Cloud, covered key IoT and mobile trends that are forcing mobile transformation, key components of a solid mobile strategy and explored how brands are effectively driving mobile change throughout the enterprise.
Aug. 31, 2016 03:00 PM EDT Reads: 788
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at Cloud Expo, Ed Featherston, a director and senior enterprise architect at Collaborative Consulting, will discuss the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
Aug. 31, 2016 02:30 PM EDT Reads: 2,098
The Internet of Things can drive efficiency for airlines and airports. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Sudip Majumder, senior director of development at Oracle, will discuss the technical details of the connected airline baggage and related social media solutions. These IoT applications will enhance travelers' journey experience and drive efficiency for the airlines and the airports. The session will include a working demo and a technical d...
Aug. 31, 2016 02:03 PM EDT Reads: 213
19th Cloud Expo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterpri...
Aug. 31, 2016 02:00 PM EDT Reads: 3,280
Although it has gained significant traction in the consumer space, IoT is still in the early stages of adoption in enterprises environments. However, many companies are working on initiatives like Industry 4.0 that includes IoT as one of the key disruptive technologies expected to reshape businesses of tomorrow. The key challenges will be availability, robustness and reliability of networks that connect devices in a business environment. Software Defined Wide Area Network (SD-WAN) is expected to...
Aug. 31, 2016 11:12 AM EDT Reads: 255
Data is an unusual currency; it is not restricted by the same transactional limitations as money or people. In fact, the more that you leverage your data across multiple business use cases, the more valuable it becomes to the organization. And the same can be said about the organization’s analytics. In his session at 19th Cloud Expo, Bill Schmarzo, CTO for the Big Data Practice at EMC, will introduce a methodology for capturing, enriching and sharing data (and analytics) across the organizati...
Aug. 31, 2016 11:00 AM EDT Reads: 483
SYS-CON Events announced today that Pulzze Systems will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Pulzze Systems, Inc. provides infrastructure products for the Internet of Things to enable any connected device and system to carry out matched operations without programming. For more information, visit http://www.pulzzesystems.com.
Aug. 31, 2016 10:45 AM EDT Reads: 469
SYS-CON Events announced today Telecom Reseller has been named “Media Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.
Aug. 31, 2016 09:30 AM EDT Reads: 1,128
Almost two-thirds of companies either have or soon will have IoT as the backbone of their business in 2016. However, IoT is far more complex than most firms expected. How can you not get trapped in the pitfalls? In his session at @ThingsExpo, Tony Shan, a renowned visionary and thought leader, will introduce a holistic method of IoTification, which is the process of IoTifying the existing technology and business models to adopt and leverage IoT. He will drill down to the components in this fra...
Aug. 31, 2016 09:00 AM EDT Reads: 558
Pulzze Systems was happy to participate in such a premier event and thankful to be receiving the winning investment and global network support from G-Startup Worldwide. It is an exciting time for Pulzze to showcase the effectiveness of innovative technologies and enable them to make the world smarter and better. The reputable contest is held to identify promising startups around the globe that are assured to change the world through their innovative products and disruptive technologies. There w...
Aug. 31, 2016 08:45 AM EDT Reads: 935
There is growing need for data-driven applications and the need for digital platforms to build these apps. In his session at 19th Cloud Expo, Muddu Sudhakar, VP and GM of Security & IoT at Splunk, will cover different PaaS solutions and Big Data platforms that are available to build applications. In addition, AI and machine learning are creating new requirements that developers need in the building of next-gen apps. The next-generation digital platforms have some of the past platform needs a...
Aug. 31, 2016 07:45 AM EDT Reads: 977
With so much going on in this space you could be forgiven for thinking you were always working with yesterday’s technologies. So much change, so quickly. What do you do if you have to build a solution from the ground up that is expected to live in the field for at least 5-10 years? This is the challenge we faced when we looked to refresh our existing 10-year-old custom hardware stack to measure the fullness of trash cans and compactors.
Aug. 31, 2016 02:45 AM EDT Reads: 1,917
The emerging Internet of Everything creates tremendous new opportunities for customer engagement and business model innovation. However, enterprises must overcome a number of critical challenges to bring these new solutions to market. In his session at @ThingsExpo, Michael Martin, CTO/CIO at nfrastructure, outlined these key challenges and recommended approaches for overcoming them to achieve speed and agility in the design, development and implementation of Internet of Everything solutions wi...
Aug. 31, 2016 02:15 AM EDT Reads: 2,311
Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more business becomes digital the more stakeholders are interested in this data including how it relates to business. Some of these people have never used a monitoring tool before. They have a question on their mind like “How is my application doing” but no id...
Aug. 31, 2016 02:00 AM EDT Reads: 2,050
Cloud computing is being adopted in one form or another by 94% of enterprises today. Tens of billions of new devices are being connected to The Internet of Things. And Big Data is driving this bus. An exponential increase is expected in the amount of information being processed, managed, analyzed, and acted upon by enterprise IT. This amazing is not part of some distant future - it is happening today. One report shows a 650% increase in enterprise data by 2020. Other estimates are even higher....
Aug. 31, 2016 01:45 AM EDT Reads: 3,128
Smart Cities are here to stay, but for their promise to be delivered, the data they produce must not be put in new siloes. In his session at @ThingsExpo, Mathias Herberts, Co-founder and CTO of Cityzen Data, will deep dive into best practices that will ensure a successful smart city journey.
Aug. 31, 2016 01:00 AM EDT Reads: 1,731