Security experts were stumped on April 7 when a new bug, Heartbleed was discovered in the web's most widely used cryptographic feature, OpenSSL. Over the last week vulnerable companies ranging from Facebook to Cisco implemented security patches, issued advisories, and urged users to change their passwords. But we are not out of the woods yet. There is another important variation to the original Heartbleed attack known as ‘Reverse Heartbleed' that exploits the same vulnerability in OpenSSL.
In the case of the Heartbleed bug a client attacks a web server to steal data from its memory, whereas in Reverse Heartbleed the roles are reversed; a web server attacks a client aka an individual user's computer to steal data. The bug can potentially steal individual usernames, passwords and other confidential information from his/her computing device be it a PC, a laptop or even a smartphone. These devices run OpenSSL when using certain web browsers, PDF readers, and file sharing applications that run locally.
Any of these computing devices could be affected if it runs a vulnerable version of OpenSSL such as OpenSSL versions 1.01 and 1.02 beta. Reverse Heartbleed, which was explicitly pointed out by security researcher Jake Williams, takes advantage of the same hitherto unnoticed programming mistake in OpenSSL, but essentially does so in reverse. Watch this video by Elastica's CTO, Zulfikar Ramzan to understand how Reverse Heartbleed operates.
How it works
Let's start with a user named Alice. Alice uses her computer to connect to a bank website over a secure SSL connection. Let's call the bank Bob's Bank. As part of her log in process, Alice enters her username, password and other credentials. These details get stored in Alice's computer's memory and are then transmitted to the bank's web server over this protected SSL connection. Now these details get stored in the bank's web server's memory. In a basic Heartbleed an attacker, let's call her Mallory, would steal data from the bank's server. But in Reverse Heartbleed, Mallory will steal the data directly from Alice's computer and not from the bank's server.
No malicious computer/web server on the internet can simply send an unsolicited message to an end-user's client computer directly; the end-user has to initiate contact. This means that Mallory's computer cannot contact Alice's computer directly, so Mallory sets up a go-between arrangement to solicit Alice's attention.
Just like how the bank has its own server, Mallory sets up her own server. Then she tries to grab Alice's attention with some links, garbed to be interesting. While this added step requires more work, it is not difficult to implement.
For example, Mallory could send an email message to Alice with a link inside it which points to Mallory's server. If Alice opens the email and clicks the link, then her computer will initiate a connection to Mallory's server. Alternatively, Mallory could post an interesting link on a social sharing website and Alice might be tricked into clicking on that link, provided it looks attractive. If Alice clicks on that link her computer will make a connection to Mallory's web server.
Imagine that link happens to be one that initiates an SSL or https: connection between Alice and Mallory. In this case Alice will have an SSL connection to Mallory's web server. Now that a connection is established between Mallory's web server and Alice's client computer, Mallory can send a message over to Alice's computer. In this case it is going to be a Heartbeat request just like that in a Heartbleed attack.
Mallory sends a Heartbeat request with a small payload, but lies and claims to have a much bigger payload. Alice's computer responds to the request by copying a large chunk of data from its memory and send it to Mallory's web server. Alice's confidential data is now with Mallory!
In a sense what we have here is a reverse of the basic Heartbleed attack. During a Heartbleed attack the attacker was a client trying to extract data from a web server. In Reverse Heartbleed, however, a web server tries to extract data from a client. But, in both cases the same vulnerability is exploited.
Reverse Heartbleed is an important vulnerability to know about as it could affect millions of users directly.
