Application Security

CrowdStrike Releases Heartbleed Scanner

After details of the critical “Heartbleed” vulnerability in OpenSSL emerged earlier this month, there has been widespread concern among system administrators, network security teams, software developers and essentially anyone with any technical connection to the Internet.

Mike Lennon

April 22, 2014

Heartbleed Scanner

In short, the Heartbleed vulnerability allows attackers to repeatedly access 64K blocks of memory by sending a specially crafted packet to a server running a vulnerable version of OpenSSL.

In response to significant concern, CrowdStrike has released a free tool aimed at helping organizations detect the presence of systems (such as web servers, VPNs, secure FTP servers, databases, routers, phones etc.) on their networks that are vulnerable to the OpenSSL Heartbleed vulnerability.

“We realized that there was a largely unmet demand for an easy to use UI tool capable of also scanning the internal networks and non-HTTPS services for this vulnerability since this problem is so much bigger than just external websites,” Dmitri Alperovitch, Co-Founder & CTO of CrowdStrike wrote in a blog post.

Developed by CrowdStrike’s Robin Keir, and released as a free tool available to anyone, CrowdStrike Heartbleed Scanner shows a list of vulnerable servers and outputs the contents of the 64kb of memory that a vulnerable server returns back to the heartbeat SSL request.

The scanner runs on both 32-bit and 64-bit versions of Windows XP or later and can be downloaded here.

Advertisement. Scroll to continue reading.

Written By Mike Lennon

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Latest News

Click to comment

Virtual Event: Threat Detection and Incident Response Summit

Wednesday, May 24, 2023

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Virtual Event: CISO Forum Virtual Summit

June 13-14, 2023

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Security Pros: Before You Do Anything, Understand Your Threat Landscape

Regardless of the use case your security organization is focused on, you’ll likely waste time and resources and make poor decisions if you don’t start with understanding your threat landscape. (Marc Solomon)

Today’s Cyber Defense Challenges: Complexity and a False Sense of Security

Industry standard frameworks and guidelines often lead organizations to believe that deploying more security solutions will result in greater protection against threats. (Torsten George)

Cutting Through the Noise: What is Zero Trust Security?

With proactive steps to move toward Zero Trust, technology leaders can leverage an old, yet new, idea that must become the security norm. (Marie Hattar)

Triple Threat: Insecure Economy, Cybercrime Recruitment and Insider Threats

A wave of layoffs, coupled with increased recruitment efforts by cybercriminals, could create the perfect conditions for insider threats to flourish (Derek Manky)

This New Era of Security Requires Secure Networking, Vendor Consolidation, and Focus on OT

The convergence of networking and security, the consolidation of technology vendors, and a focus on OT security are essential underpinnings of any organization's success. (John Maddison)

Application Security

Source Code Security Firm Cycode Launches With $4.6 Million in Funding

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Eduard KovacsSeptember 24, 2019