They claim to have found a vulnerable Web agent on one of the top five social networks that was fetching URLs to generate previews. The exploit allowed them to extract internal API call results and Python source code snippets from the application's memory. The social network was not named because a fix has yet to be confirmed.
In another case, Reddit used a vulnerable agent that parsed URLs to suggest names for new posts, the Meldium team said. "The memory we were able to extract from this agent was less sensitive, but we didn't get as many samples because they patched so quickly."
The team also managed to register a malicious webhook on rubygems.org, a website that hosts Ruby programs and libraries known as gems, that called back their exploit URL when a new package was published.
"Within a few minutes, we captured chunks of [Amazon] S3 API calls that the Rubygems servers were making," the team said. "After the disclosure, they quickly updated OpenSSL and are now protected."
Meldium created an online tool to generate custom URLs that can be fed into any Web agent to test if it's vulnerable to reverse Heartbleed attacks.
"The important takeaway is that it's not enough to patch your perimeter hosts -- you need to purge bad OpenSSL versions from your entire infrastructure," the Meldium team said. "And you should keep a healthy distance between agent code that fetches user-provided URLs and sensitive parts of your systems."
While the threat is not as broad as for traditional clients and servers, many sites do access user-controlled URLs and create a valid Heartbleed attack vector that needs to be pointed out, said Carsten Eiram, the chief research officer at vulnerability intelligence firm Risk Based Security, via email. "I'm sure some companies providing such features acting as TLS clients forget about them when patching their servers."
OpenSSL is also used by Web services, the programmatic interfaces that provide data feeds for machine to machine communication as well as auxiliary data to both Web clients and servers, said Philip Lieberman, president of Lieberman Software, via email. "Protocols such as SOAP, REST and JSON can be potentially attacked in variations of the Heartbleed scenario."
"Administrators are currently in triage mode -- addressing the problems that are most obvious and most under public scrutiny," said Brendan Rizzo, technical director for EMEA at Voltage Security, via email. "Attackers, on the other hand, generally avoid the 'front door' and will be shifting their focus to these secondary attack vectors."
OpenSSL versions 1.0.1 through 1.0.1f are seriously broken and should be removed from all code as soon as possible, said Lamar Bailey, director of security R&D at Tripwire, via email. "We will see malicious servers popping up to exploit 'reverse Heartbleed' any minute now but people should also beware of all of these 'public test servers' for Heartbleed because they can easily log vulnerable targets and use this as an attack map."