Heartbleed is a catastrophic bug that affects thousands of sites and services across the internet, but what is it, and what do you need to do about it to protect yourself from cybercriminals?
According to security researchers, around half a million sites worldwide are rendered insecure by the bug. "Catastrophic is the right word," commented Bruce Schneier, an independent security expert. "On the scale of 1 to 10, this is an 11."
Heartbleed has grabbed the attention of the world’s media, but there has been a lot of misinformation bandied around. Here’s a quick rundown of the important bits you should know about.
What exactly is Heartbleed?
Heartbleed is the nickname given to a bug in a piece of security software used by almost every secure website on the internet.
It is a flaw in a software package called OpenSSL, which is used by banks, shops, email providers and a plethora of other services across the web to secure a connection between the user and the service.
Web servers that use SSL securely send an encryption key to the visitor, which is then used to protect all other information coming to and from the server.
Most people will recognise this secure connection as the little padlock symbol in the top left-hand corner of the web browser.
What does the bug do?
SSL is crucial in protecting services like online shopping or banking from eavesdropping, as it protects users from so-called man in the middle attacks, where a third party intercepts data during transit and uses it to discover confidential information.
Heartbleed allows miscreants to read data assumed to be sent securely over the internet. That means that usernames and passwords as well as other confidential data could be read by cyber criminals. Heartbleed has also been implicated as one of the ways the US National Security Agency (NSA) has been able to read secure data as part of its Prism online surveillance programme.
How long has this been an issue?
The bug was introduced into the OpenSSL software in March 2012 and has been out in the wild for the past two years.
It has only now been revealed, but criminals and the NSA have been able to exploit the bug since its inception in 2012. It is unknown whether any criminals have actively been exploiting the bug to steal user data, however.
Am I affected?
Hundreds of thousands of sites and services across the internet use a secure connection between a user's computer and the website, and of those thousands, a large proportion of will be hit by Heartbleed.
There is a very high chance that at least one service that you use will be affected, but the degree to which it is affected will be different between sites and services. For instance, secure password manager LastPass was affected by the Heartbleed bug, but subsequent layers of encryption meant that user data was never exposed.
The end result is that user data could now be intercepted and stolen across a myriad services that people use every day, including internet shopping sites, email accounts, online banking and even news websites.
What’s happening now?
The Heartbleed bug is quite easy to fix, but requires all the sites and services affected by the vulnerability to update their software and their security certificates.
Some, like Google, Yahoo and most banks, have already done that, but others will take time to roll out the fix.
What should I do?
For the majority of users, their data is only at risk from Heartbleed when they use the sites and services. The advice currently being issued by security experts is to avoid using any site or service hit by Heartbleed until they have fixed the bug.
It is advisable, therefore, to avoid logging into internet banking, online shopping or anything that has a credit card or personal data attached until you can verify that they have fixed the issue.
A couple of tools are available on the internet to check whether sites are still vulnerable to the Heartbleed bug.
Do I need to immediately change all my passwords?
There have been a lot of knee-jerk warnings in the media stating that you should immediately change all your passwords. This advice is wrong.
It is advisable to change all your passwords, but only once the sites have fixed the Heartbleed bug, especially if you reuse the same password across multiple sites and services. Changing your password before will only put that new password at risk of being stolen through the Heartbleed bug.
Once a site has fixed the Heartbleed bug, picking a secure new password for each service is crucial. A password should be complex, but memorable and should be unique for each different site or service.
If I just ignore it, will it all be all right in the end?
Heartbleed is certainly one of the most serious security bugs to hit the open internet, but panicked reactions have made it worse.
The Heartbleed bug will be fixed, if it hasn’t already been, by all the sites and services that most users use on a day-to-day basis. At that point changing your password should make your accounts secure once again, and users can then go on about their daily basis as they have done before.
Vigilance over the next weeks and months over important accounts, including banking and shopping sites is advisable, just in case someone has managed to steal your credit card details while the bug was wide open.
Reference:
Heartbleed bug: what do you actually need to do to stay secure?
http://www.theguardian.com/technology/2014/apr/10/heartbleed-bug-everything-you-need-to-know-to-stay-secure
No comments:
Post a Comment