As far as I know, it only affects anything running as a server and using encryption as mentioned in the second quote of the OP.

I don't think it applies to SOHO modems/routers.

But my knowledge in this area is very limited, hopefully someone more expert will comment.

In reply to a post by asrdesigns:

So, is there any chance that this applies to our SOHO modem / routers?

Not in the manner you are thinking of, no. It may effect the web server service running on your router for remote management, but you probably shouldn't have that exposed to the internet anyway because we all know how poor home/SOHO router manufacturers are at producing secure management for their routers.

In reply to a post by billford:

I don't think it applies to SOHO modems/routers.

Many routers running open source based firmware will be affected. Some DD-WRT versions certainly are.

It also seems that many Cisco products have OpenSSL at their core;

http://tools.cisco.com/security/center/content/Cisco...

I am sure there are more manufacturers unsing OpenSSL.

Edited by caffn8me (Wed 09-Apr-14 20:08:23)

Just a little bit of re-assurance for the nervous:

In reference to techcrunch.com/2014/04/07/massive-security-bug-in-openssl-could-eff...:

It seems the bug has been in OpenSSL for 2+ years (since December 2011, OpenSSL versions 1.0.1 through 1.0.1f) before its publicly announced discovery today.

Glad I can't afford a Cisco router

Saw this site mentioned if anyone wants to check out a site they use, but no idea how reliable the result are.

..but if Cisco are using OpenSSL you can bet other manufacturers are. I know Sun Microsystems did.

To reassure folks a little bit;

In reference to www.bbc.co.uk/news/technology-26954540:

A researcher at the University of Cambridge Computer Laboratory said it would be an overreaction to say everyone should drop what they are doing to reset all their passwords, but that those concerned should still act.

"I think there is a low to medium risk that any given password has been compromised," said Dr Steven Murdoch.

"It's not the same as previous breaches where there's been confirmed password lists posted to the internet. It's not as urgent as that.

Edited by caffn8me (Wed 09-Apr-14 20:59:17)

All depends on what version of openSSL was used by the website too

It does indeed. I've checked all the secure websites I use and none is affected as none uses OpenSSL. My own servers, which would have been affected, currently aren't running HTTPS

I do run SSH on numerous servers that had the previous vulnerable version of OpenSSL but they are firewalled to allow SSH access only from specific locations (in two cases only on private IP addresses via VPN)

Do all secure sites use SSL?

As looking on https://github.com/musalbas/heartbleed-masstest/blob... it says

live.com... no SSL

however live.com is a secure site

Yes. SSL/TLS is the standard.

live.com negotiated TLS 1.0 with my browser.