<div dir="ltr">Thanks for this discussion. I actually did know all this already, and we've been discussing it thoroughly on my team -- I was just curious what the InC recommendations were regarding certs in the InC Metadata. I posted that to the InC Participants list, btw, so also, thanks for the clarification on which list to post to.<div>
<br></div><div>Don't get me wrong -- this discussion is extremely useful.</div><div><br></div><div>Thank you everyone.</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Apr 8, 2014 at 1:32 PM, Andy Bennett <span dir="ltr"><<a href="mailto:andyjpb@knodium.com" target="_blank">andyjpb@knodium.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Jeff,<br>
<div class=""><br>
> I've tried due diligence before posting this question but the best<br>
> answer I can derive is "maybe"<br>
><br>
> - We don't have any reason to believe we've been compromised<br>
> - We are only running Shib SP services<br>
> - We've applied patches to everything from our vendor<br>
<br>
</div>You can only have been compromised if you are running a vulnerable<br>
version of the software.<br>
<br>
If you are in a position where you are running a vulnerable version of<br>
the software then you *may* have been compromised. As this attack is<br>
undetectable in logs then you should assume that you *have* been<br>
compromised and act accordingly. You should consider any data that the<br>
vulnerable process has access to be at large. This includes<br>
certificates, passwords and user data.<br>
<br>
<br>
The vulnerable versions of the software are:<br>
<br>
+ OpenSSL 1.0.1 to 1.0.1f inclusive<br>
<br>
+ 2.5.x versions of the Shibboleth SP<br>
package for Windows.<br>
<br>
...and potentially others that I have missed.<br>
<br>
(Thanks to Ian Young for version info.)<br>
<br>
Earlier versions of OpenSSL are not vulnerable.<br>
<br>
<br>
<br>
Check out the following website for a (non Shibboleth related)<br>
explanation of the situation:<br>
<br>
<a href="http://heartbleed.com/" target="_blank">http://heartbleed.com/</a><br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
Regards,<br>
@ndy<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
<a href="mailto:andyjpb@knodium.com">andyjpb@knodium.com</a><br>
<a href="http://www.knodium.com/" target="_blank">http://www.knodium.com/</a><br>
<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div style="text-align:left">Jeffrey D. Silverman • Moodlerooms, Inc.</div><div style="text-align:left">(410) 779-3425 • <a href="mailto:jeff@moodlerooms.com" target="_blank">jeff@moodlerooms.com</a></div>
</div>
<br>
<span style="background-color:rgb(255,255,255)">This email and any attachments may contain confidential and proprietary information of Moodlerooms that is for the sole use of the intended recipient. If you are not the intended recipient, disclosure, copying, re-distribution or other use of any of this information is strictly prohibited. Please immediately notify the sender and delete this transmission if you received this email in error.</span>