Some services advising internet users to change all their passwords due to Heartbleed bug

4/9/14, "'Change every password everywhere': Heartbleed's threat to Web security," AP via Globe and Mail, M. Liedtke, A. Jesdanun, San Francisco

"Some popular sites that may have been affected: The CRA, Yahoo, Flickr, OkCupid, Eventbrite, Indiegogo, Imgur."...

-----------------------------------------

4/9/14, "A digital heart attack," economist.com, San Francisco

"The Heartbleed Bug sounds like a particularly nasty coronary complication. But it is in fact a software flaw that has left up to two-thirds of the world’s websites vulnerable to attack by hackers.

According to researchers who uncovered the bug in popular encryption software, it can be exploited by nefarious types—and prying spooks—to extract everything from user names and passwords to details of people’s bank accounts and corporate secrets.

Since the bug’s existence was publicly revealed on April 7th, companies have been scrambling to install software patches that fix the flaw or to upgrade to newer versions of the encryption software, which do not contain it. Tumblr, a blogging service owned by Yahoo, has been advising users to change their passwords for all of the secure sites that they use that hold sensitive data.

Expect many other web outfits to issue similar warnings soon.

Ironically, the weakness that has been exposed is in software that was designed to make the internet safer. Secure websites typically have web addresses that begin with HTTPS, in which the S refers to SSL, or Secure Socket Layer, a widely used technology that encrypts data before it is sent. (Users can see a little lock icon at the start of a web address when they visit a website that employs the technology.)

To protect themselves and their users, many sites have turned to OpenSSL, a popular library of open source encryption software. The snag is that one version of this software that has been on sale since March 2012 contains a serious coding error. The software has a “heartbeat” feature, which lets a computer at one end of an encrypted link send a signal to the computer at the other end of it to check that it is still online. Codenomicon, a security firm, and Neel Mehta of Google’s security team, discovered that a savvy hacker can exploit a weakness in the code and replicate this signal, using it to trick a server into spewing out data from its memory.

Savvy hackers can then use software to comb through the data to extract passwords and other sensitive information. They can also get their hands on encryption keys which can be used to decipher encrypted traffic flowing to and from the computer. To make matters worse, the researchers found that the Heartbleed Bug allows attacks to be mounted without leaving a trace in server logs, so victims may well be unaware that their systems have been compromised. This means it is impossible to tell exactly how much damage has been done because of the flaw’s existence.

Sometimes news of bugs leaks out before software patches are available to fix them. In this case, however, the researchers tipped off the relevant folk associated with OpenSSL about their findings before going public with them, which meant that by the time the news broke software fixes were to hand. Even so, some firms clearly needed more time to prepare themselves.

The revelation of the Heartbleed Bug's existence will trigger more discussion about how best to deal with security flaws that are unearthed by researchers. It will also reinforce the impression amongst the general public that cyberspace cannot be trusted. In response, the software industry should redouble its efforts to stop serious flaws being introduced into code when it is written. That will not be easy, but it is time to make a wholehearted push to see what’s possible."

Tweet Stumbleupon StumbleUpon