The Matter of Heartbleed

By Zakir Durumeric, Frank H. Li, James Kasten, J. Amann, Jethro Gideon Beekman, Mathias Payer, Nicolas Weaver, David Adrian, Vern Paxson, Michael Bailey and 1 more. ACM/SIGCOMM Internet Measurement Conference, 2014

803 citations recorded by the source corpus.

The Heartbleed vulnerability took the Internet by surprise in April 2014. The vulnerability, one of the most consequential since the advent of the commercial Internet, allowed attackers to remotely read protected memory from an estimated 24--55% of popular HTTPS sites. In this work, we perform a comprehensive, measurement-based analysis of the vulnerability's impact, including (1) tracking the vulnerable population, (2) monitoring patching behavior over time, (3) assessing the impact on the HTTPS certificate ecosystem, and (4) exposing real attacks that attempted to exploit the bug. Furthermore, we conduct a large-scale vulnerability notification experiment involving 150,000 hosts and observe a nearly 50% increase in patching by notified hosts. Drawing upon these analyses, we discuss what went well and what went poorly, in an effort to understand how the technical community can respond more effectively to such events in the future.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/f1e4a993f6018ff346175b6cfbd784d8874e53dc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

An Overview of Catastrophic AI Risks (2023, background): “Even in technologies adhering to rigorous safety and security standards, undiscovered vulnerabilities may persist, as demonstrated by the Heartbleed bug—a serious vulnerability in the popular OpenSSL cryptographic software library that remained undetected for years before its eventual discovery [85]”
Understanding the Mirai Botnet (2017, background): “Recent examples include alerting device administrators via CERT bulletins, emailing the abuse contact in WHOIS records, and in-browser warnings to site owners that a page is compromised [24,56,57].”
Algorithms and their others: Algorithmic culture in context (2016, background): “…security, for example, there have been a number of headline cases lately where trusted code did not in fact correctly implement the algorithm that it was meant to embody, leaving systems open for attack and data breaches; the ‘‘Heartbleed’’ incident is among the best known (Durumeric et al., 2014).”
Hacking in Darkness: Return-oriented Programming against Secure Enclaves (2017, background): “This question is important, as such vulnerabilities have been found in a wide range of applications, including security applications [4, 12, 13].”
A Search Engine Backed by Internet-Wide Scanning (2015, background): “There have been a large number of research studies over the past several years that have been based on Internet-wide scanning [1,7–11,13,14,18,19,24–29,38], which encouraged us to develop Censys.”
Moat: Verifying Confidentiality of Enclave Programs (2015, background): “The second kind of attack, which we call application attack , is due to errors or vulnerabilities in the application code itself which can be exploited to leak conﬁdential information from the application (e.g., the Heartbleed bug [18]).”
Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter for Predicting Real-World Exploits (2015, background): “USENIX Association 24th USENIX Security Symposium 1041”