There is no way to know for sure. The exploit leaves no trace unless you were looking for it with something like very specific network detection signatures.�<div><br></div><div>As I&#39;ve said before, there are 3 required steps.�</div>
<div><br></div><div>Identify effected equipment.�</div><div>This could be anything linking to OpenSSL. Web servers, mail servers, VPN servers even routers which use TLS to secure configuration sessions.�</div><div><br></div>
<div>Patch effected equipment.�</div><div>All of it. Do it now or turn it off.�</div><div><br></div><div>Revoke and reissue all key material and Certs.�</div>If you use PKI in anger then key/cert rollovers should have been part of an emergency plan anyway. You&#39;ve all got emergency key rollover procedures�in place for DNSSEC as well right :)<div>
<br></div><div>Do all the steps.�</div><div>It&#39;s like people who try and bargain or rationalise�their way out of rebuilding�<span></span>servers they know have been compromised. We all know its best practice, just do it.�</div>
<div><br></div><div><br></div><div>Dean�<br><div><br>On Wednesday, April 9, 2014, Don Stokes &lt;<a href="mailto:don@daedalus.co.nz">don@daedalus.co.nz</a>&gt; wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Is there any indication out there as to how widely this bug has been<br>
exploited? I.e. if you&#39;ve patched servers in the last 24 hours, how<br>
likely is it that your certificate keys have been leaked over the last<br>
months / year?<br>
<br>
Not looking for accurate numbers, just roughly where on the scale of,<br>
&quot;this is possible but no reports of actual use&quot; to &quot;all the black hats<br>
have been doing this for years so you&#39;re screwed unless you re-issue and<br>
revoke your certs&quot; the exploit lies.<br>
<br>
Also, last time I worried about this, certificate revocation was, uh,<br>
largely unimplemented. That was a while ago. How well does it work now?<br>
And with potentially large numbers of revoked certs?<br>
<br>
-- don<br>
<br>
_______________________________________________<br>
NZNOG mailing list<br>
<a href="javascript:;" onclick="_e(event, &#39;cvml&#39;, &#39;NZNOG@list.waikato.ac.nz&#39;)">NZNOG@list.waikato.ac.nz</a><br>
<a href="http://list.waikato.ac.nz/mailman/listinfo/nznog" target="_blank">http://list.waikato.ac.nz/mailman/listinfo/nznog</a><br>
</blockquote></div></div>