Annotated Bibliography: The Matter Of Heartbleed

The Matter of Heartbleed
*Zakir Durumeric1, James Kasten1, David Adrian1, J. Alex Halderman1, Michael Bailey1,2 1 University of Michigan 2 University of Illinois, Urbana Champaign {zakir,jdkasten,davadria,jhalderm}@umich.edu, [e-mail]
*Frank Li3, Nicholas Weaver3,4, Johanna Amann4, Jethro Beekman3, Mathias Payer3,5, Vern Paxson3,4 3 EECS, University of California, Berkeley 4 International Computer Science Institute 5 Purdue University {frankli,nweaver,jbeekman,vern}@cs.berkeley.edu, [e-mail],[e-mail]
ABSTRACT TheHeartbleedvulnerabilitytooktheInternetbysurpriseinApril 2014. Thevulnerability,oneofthemostconsequentialsincethead- ventofthecommercialInternet,allowedattackerstoremotelyread protected memory from an…show more content…
Akeymethodologicalissuewithconductingsuchacomparison concernsensuringweusean“apples-to-apples”metricforassess- ing the extent of the community’s response to each event. The comparison is further complicated by the fact that our Heartbleed measurementssampleadifferent1%oftheInterneteachscan. We do the comparison by framing the basic unit of “did an affected partyrespond”intermsofaggregateentitiesverylikelycontrolled bythesameparty(andthuswillupdateatthesametime). Todoso, we define an entity as a group of servers that all present the same certificateduringaparticularmeasurement. Thishasthepotential forfragmentinggroupsthathavepartiallyreplacedtheircertificates, but we argue that this effect is likely negligible since the number of entities stays roughly constant across our measurements. Note that this definition of entity differs from the “host-cert” unit used in [72], in which groups were tracked as a whole from the first measurement. Figure4showsforbothdatasetsthefractionofunfixedentitiesto thetotalnumberofentitiespermeasurement. Weconsideranentity as“fixed”intheDebianPRNGdatasetifthecertificatenowhasa strongpublickey(andpreviouslydidnot),otherwise“unfixed”. For ourHeartbleedIPv4dataset(labelled“patch”),wedeemanentity as“fixed”ifallserverspresentingthesamecertificatearenowno longervulnerable,“unfixed”otherwise. This data shows that entities vulnerable to Heartbleed patched somewhatmorequicklythanintheDebianscenario,andcontinue to do so at a faster rate. It would appear that aspects of the disclo- sure and publicity of Heartbleed did indeed help with motivating patching,althoughtheexactcausesaredifficulttodetermine. NotethatfortheDebianevent,itwasveryclearthataffectedsites hadtonotonlypatchbuttoalsoissuenewcertificates,becausethere was no question that the previous certificates were compromised. For Heartbleed, the latter step of issuing new certificates was not as pressing, because the previous certificates