Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I connect to the internet on a secured wireless connection. I'm pretty sure nobody has MITM'd me on my LAN. How else could someone using Heartbleed to steal private keys access my data? I understand that they can decrypt my communications, but I use sites where I enter my password without SSL, and to my knowledge nobody has ever compromised any of my accounts? Why is it such a security risk if MITMs are rare for me?

share|improve this question

closed as primarily opinion-based by Ƭᴇcʜιᴇ007, Heptite, Moses, random Apr 14 '14 at 19:40

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote -1 down vote accepted

You have to differentiate between MITM and someone intercepting your traffic.

For unencrypted traffic (and logins), an attacker just needs to sit somewhere between you and the server you are connecting to. He can then sniff your password from the network, or any other information that is exchanged.

For encrypted traffic this isn't as easy. To attack an encrypted connection MITM (man in the middle) is used. As the attacker does not know the key that is used by the server, the attacker pretends to be the server to you. He then connects to the server and pretends to be you, forwarding your original request.

Instead of one encrypted connection between you and the server, there will be two. One between you and the attacker, and a second one between the attacker and the server.

This could be easily detected by you, if you care to check the key that the server presents to you while connecting. As the attacker needs to use his own key, you can quickly realize that you are not really talking to the server.

With HEARTBLEED things get ugly right here. Heartbleed allows an attacker to obtain the original secret key directly from the server. At this point, you have no chance to figure out that you are being attacked.

If you are using unencrypted connections all the time, HEARTBLEED doesn't affect you negatively.

This is comparable to driving without a seatbelt on, when it is announced that there is an issue with some seatbelts that might cause them to unlock in a crash. It doesn't matter for you, because you are taking advantage of readily available safety devices.

PS: Heartbleed leaks random data. It can be the private key, or anything else the server currently has in memory. Leaking the private key is just considered to be the worst case in this scenario.

TL;DR: MITM attacks are rare, because they are hard to set up and are easily detected. Heartbleed is serious, because you can not detect it and it is much easier to apply.

share|improve this answer
You are not answering the question: HeartBleed is not a MITM attack – Jan Doggen Apr 14 '14 at 13:25
I specifically address the fact that Heartbleed and MITM are something entirely different. If that is unclear to you, feel free to improve the wording. – Squeezy Apr 14 '14 at 16:57
@Squeezy both answers were good, but in my opinion this answer explained it better for me. – Cameron Apr 15 '14 at 8:44

Heartbleed does not require a man-in-the-middle attack to compromise a system. In fact, you don't even have to be connected to the vulnerable site for your personal information to be compromised.

The heartbleed defect in OpenSSL allows an attacker to read bits of information stored in memory on the vulnerable system.

Reading should answer most of your questions.

share|improve this answer
Woops, I didn't think about that. Surely it would be unlikely that information about you would be stored in the memory if you weren't accessing the site though? – Cameron Apr 13 '14 at 19:05
@Cameron Session information can be stored if an option to stay logged in is offered – Ramhound Apr 13 '14 at 20:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.