Web Security

Question 1

List five fields that are in a typical server certificate

Answer 1

1. Subject: The identity of the webiste
2. Issuer: The Certificate Authority that issued the certificate
3. Public Key: The server’s public key, used during key exchange
4. Validity Period: The start and end dates during which the certificate is valid.
5. Signature: The CA’s digital signature that verifies the certificate’s authenticity.

Question 2

How did Heartbleed attack work?

Answer 2

-A client would send heartbeat request to he server, including some data and a claimed length
-The server was supposed to send back the same data
-But the OpenSSL didn’t check if the claimed data length was accurate
0An attacker could send a small amount of data and claim it was much longer
-The server would then respond with that many bytes from its memory, including private keys, passwords, or sensitive data