After details of the critical “Heartbleed” vulnerability in OpenSSL emerged earlier this month, there has been widespread concern among system administrators, network security teams, software developers and essentially anyone with any technical connection to the Internet.
In short, the Heartbleed vulnerability allows attackers to repeatedly access 64K blocks of memory by sending a specially crafted packet to a server running a vulnerable version of OpenSSL.
In response to significant concern, CrowdStrike has released a free tool aimed at helping organizations detect the presence of systems (such as web servers, VPNs, secure FTP servers, databases, routers, phones etc.) on their networks that are vulnerable to the OpenSSL Heartbleed vulnerability.
“We realized that there was a largely unmet demand for an easy to use UI tool capable of also scanning the internal networks and non-HTTPS services for this vulnerability since this problem is so much bigger than just external websites,” Dmitri Alperovitch, Co-Founder & CTO of CrowdStrike wrote in a blog post.
Developed by CrowdStrike’s Robin Keir, and released as a free tool available to anyone, CrowdStrike Heartbleed Scanner shows a list of vulnerable servers and outputs the contents of the 64kb of memory that a vulnerable server returns back to the heartbeat SSL request.
The scanner runs on both 32-bit and 64-bit versions of Windows XP or later and can be downloaded here.
Related: Heartbleed Flaw Used to Bypass Two-factor Authentication, Hijack User Sessions: Mandiant
