That tool is using a really poor detection method for this vulnerability. Just because a server is using Apache and OpenSSL certainly doesn't make it automatically vulnerable to this problem.
Tried that not long ago and it did not work. A friend of mine had troubles, too. Also tried the "I forgot my password" option, did not work either. Some useless error message when trying to save a new password from the link in the email.
Actually, running OpenSSL is the highest risk factor. That's why the test's point, the only point, is to see if a site has been/still is vulnerable based on what's running on the server. There is no test, apart from what a website's own admins can do, that can tell if any given site has been exploited against. A corollary is determining someone's risk for HIV: "Are you promiscuous?" or "Do you share needles?" do not test for the actual guarantee infection, but it can give someone an idea if he should get tested.
I'm hardly "incorrect," whether "almost everything" or not. I was speaking in a very broad sense about "running OpenSSL," because most on this forum don't need or don't care about the particulars. Do you note the original question? It wasn't about whether Origin or EA are running vulnerable versions of OpenSSL, but the broad question that 99.9% of users are asking. It's a rare home user will ask, "Hey, has the admin patched the latest fixed version of OpenSSL?"
I am glad for both but I am sure you will appreciate the importance of a sense of caution.
Err, actually the original question was precisely whether EA/Origin were vulnerable and whether the admin had patched it...
Actually, there are now web-based tests which are specifically aimed at checking for this vulnerability. No scripts needed:
Unfortunately, since this exploit leaves no trace of its operation on the server, even administrators cannot tell if they have been compromised by this issue. From a security perspective, it is always best to assume the worst case and if a vulnerable version was known to be used then users should change their passwords and admins should patch and regenerate their SSL certificates accordingly (which appears to have been precisely what they have done for the accounts.eamythis.com domain.)
There are probably thousands of them being attacked by it right now after its public disclosure. The Yahoo servers were used in one of the initial tests to retrieve passwords.
I does no good to change passwords before the servers are patched. If you are worried about this vulnerability, anything you type to a vulnerable server can be intercepted....
Of course, that advice applies to users too. Changing your passwords and assuming the current passwords you're using are comprimised won't do you any harm.
My point was that the original question was very general, not asking about any OpenSSL versions. Most home users don't care what particularly needs fixing or what needs to be, just that it is.
That's now (in fact I had been checking out the latter link a while ago). But when someone asked in the early morning, I was giving an answer that was valid as an assessment of general risk. That's hardly "incorrect" in "almost everything," don't you think?
I was again talking in a general sense about "only admins can know." Sometimes they can't, of course. It's this kind of exploit that makes an admin's hair fall out, but the regular home user still had tests early on for determining if a specific site could have been compromised.Unfortunately, since this exploit leaves no trace of its operation on the server, even administrators cannot tell if they have been compromised by this issue. From a security perspective, it is always best to assume the worst case and if a vulnerable version was known to be used then users should change their passwords and admins should patch and regenerate their SSL certificates accordingly (which appears to have been precisely what they have done for the accounts.eamythis.com domain.)
Of course, that advice applies to users too. Changing your passwords and assuming the current passwords you're using are comprimised won't do you any harm.
There are probably thousands of them being attacked by it right now after its public disclosure. The Yahoo servers
I'm not sure about who is making sex references but if my video leads somebody to believe that nope.
Here's another good resource:
I recently lost all of my AIM accounts and my old AOL E-Mail account due to what most people believe is an AOL-based reset, but now I wonder if it has to do with Heartbleed. Meh.
. .