Slides from my talk about how the HeartBleed OpenSSL vulnerability affects Apache CloudStack and how to mitigate the vulnerability. From CloudStack Collaboration Conference 2014 in Denver, CO

1. CloudStack and “HeartBleed”

2. We’re here to talk about…

3. What is Vulnerable
• Apache CloudStack 4.2 – 4.3
• SystemVMs have vulnerable version of OpenSSL installed
• In particular, SSVM is running vulnerable services

4. FRIENDS DON’T LET FRIENDS
USE REALHOSTIP

5. Status
• Apache CloudStack has issued patch instructions
• We’re working on updated SystemVM templates

6. How to patch
• ssh to SystemVM
• apt-get update
• apt-get install openssl libssl1.0.0
• /etc/init.d/apache2 restart

7. How to verify
dpkg -l|grep ssl
ii libssl1.0.0:i386 1.0.1e-2+deb7u6 i386 SSL shared libraries
ii openssl 1.0.1e-2+deb7u6 i386 Secure Socket Layer (SSL) binary

8. External tests
• http://filippo.io/Heartbleed/
• https://gist.github.com/takeshixx/10107280 - run yourself

9. Honeypot
Using http://packetstormsecurity.com/files/126068/hb_honeypot.pl.txt
$ sudo perl heartbleed_honeypot.pl
182.118.60.51
182.118.60.51
182.118.60.51
182.118.60.51

10. Honeypot sniff

11. Honeypot sniff

12. Honeypot sniff

13. ASF Infrastructure team:
“Thank you for your patience while we have worked to sort this out.
We expect to reset all LDAP passwords within the next 48 hours or so,
so do not be alarmed when your password stops working.”

14. kthxbye!
• http://cloudstack.apache.org
jlk@stratosec.co
@johnlkinsella