Performing the Heartbleed Attack After the TLS Handshake
Summary: Cisco Talos reported that many proposed IPS rules for detecting Heartbleed compare TLS message size to heartbeat message size, a method that only works against proof-of-concept attacks run before the TLS handshake, when data is sent in plaintext. When the handshake happens first, heartbeat data is encrypted, so comparing ciphertext to the unencrypted TLS message size fails and almost always produces a false positive; Talos instead built its own proof-of-concept by patching openssl-1.0.1f to send malicious heartbeats after the handshake, and detects attacks using threshold rules for too many heartbeat requests in a short time plus inspection of the TLS size in heartbeat responses.
What you should know: Detection rules that assume they can read heartbeat message size will fire on legitimate encrypted traffic, so a security leader relying on those signatures gets false positives rather than coverage against attackers who complete the TLS handshake first.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026