PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

In Heartbleed’s Wake: A Password Primer

bishopfox.com | blog | #authentication | #openssl | #best-practices | #security-awareness | #passwords | #heartbleed
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox's Christie Terrill revisits password security after Heartbleed: the OpenSSL bug leaked server memory holding keys and credentials, and leading practices limit the damage of such exposures.
Published
Collected

Related coverage

blog · bishopfox.com
Examining The Impact Of Heartbleed
Tim Sapio's analysis of Heartbleed (CVE-2014-0160): since March 2012 the OpenSSL bug let unauthenticated attackers read server memory — keys, credentials, traffic — across vast swaths of the web.
blog · blog.trailofbits.com
Using Static Analysis and Clang To Find Heartbleed
Trail of Bits built a Clang analyzer plugin that statically detects Heartbleed-style bugs: it taints ntohl/ntohs return values and flags unconstrained data used as memcpy sizes, tested on OpenSSL.
blog · netspi.com
Passwords: Strength and Longevity vs. Uniqueness
Uses the LinkedIn and eHarmony password breaches as a teachable moment: instead of repeating strength rules, emphasize unique passwords per site, since leaked hashes eventually crack.
vulnerability · blog.trailofbits.com
Vulnerability Modeling with Binary Ninja
Trail of Bits shows automated vulnerability discovery on stripped binaries, using Binary Ninja's MLIL and SSA forms with a theorem prover to model and rediscover the Heartbleed bug in OpenSSL.
blog · bishopfox.com
Before You Red Team: Fix These 5 Common Mistakes
Bishop Fox's red team lead flags five recurring mistakes — poor secrets management, excessive privileges, flat networks, user-training over-reliance, weak detections — seen in ~90% of engagements.
blog · bishopfox.com
Cyber Mirage: How AI is Shaping the Future of Social Engineering
Bishop Fox breaks down how deepfakes and voice clones are built — data collection, training, inference — cites a $25M Hong Kong fraud, and outlines defenses against AI-driven social engineering.
Back