Saturday, April 12, 2014

Heartbleed Bug



Even if you read a little about tech news, I doubt you may not have not heard the name Heartbleed bug. It has shaken the internet geeks! But what is this buzz all about?

What is a Heartbleed?

Heartbleed bug is a serious vulnerability in one of the implementation of SSL/TLS cryptography protocol which is OpenSSL. The scary thing is, OpenSSL is used by the 2/3 of the websites on the internet. And this bug went undetected for 2 years.

How serious is this bug?

Quoting the security expert Bruce Schneier,  
            "Catastrophic" is the right word. On the scale of 1 to 10, this is an 11.

What is the risk?

This security bug can allow attacker to read arbitrary 64kb chunk of server memory. The vulnerability lets a hacker access up to 64 kilobytes of server memory, but perform the attack over and over again to get lots of information.  This allows the tracking the username, passwords and cookies. The Heartbleed bug is putting millions of passwords and credit card numbers at risk.

As reported by Mark Loman, he was able to see username and password in plaintext using this vulnerability.


What can I do to make sure I am secure?

If you have access to server, you will need to install latest OpenSSL patch. If you are just a user, you can do nothing until website / web server administrator has fixed the issue. Once the issue is fixed at sites, we recommend you to change your passwords ASAP. To check if the issues is fixed on  aparticular site, check : http://filippo.io/Heartbleed/ .

How do I know if I am not compromised?

Unfortunately, exploitation of this bug leaves no traces of anything abnormal happening to the logs as said on heartbleed.org . You won't find any abnormality in your log if you've been compromised.

Which famous sites were affected by this bug?

Being a most famous SSL implementation, this was being used by most of the website. Few of the famous sites allegedly affected are below:
·         Facebook
·         Instagram
·         Pinterest
·         Tumblr
·         Twitter
·         Google
·         Yahoo
·         Gmail
·         Yahoo Mail
·         GoDaddy
·         Intuit Turbo Tax
·         Dropbox
·         Minecraft
·         OkCupid
·         Stackoverflow

7 comments:

  1. I'm looking for designs for my medical website. I have a lot of people who come through there and it's very bland. I hope to have it fixed soon.
    John Bond | http://www.mednet-tech.com/services/web-design

    ReplyDelete
  2. You are just a user, you can do nothing until website / web server administrator has fixed the issue.

    eSignature

    ReplyDelete
  3. Cyntox is only a reliable name in medical waste disposal and medical waste management. If you need any type of medical waste removal services then Cyntox is market leader.

    ReplyDelete
  4. Get used MRI Scanners and other refurbished equipments used in medical from Masters Medical serving all over India. For more info visit http://www.mastersmed.com/Aboutus.aspx

    ReplyDelete
  5. We at Morigon Technologies pride ourselves in being able to assist healthcare facilities with all their healthcare technology management. The key to our success is to know what our customers expect of us, committing the resources (staffing and management) to ensure successful outcomes and most importantly monitoring our performance with the use of metrics and surveys. We send our highly qualified technicians for Medical Equipment Repair, Medical Forensic Investigation, Hospital Bed Repair and healthcare technology management in the field not only to provide a service but to assure your facility that the life saving equipment you use remains calibrated, ready for use, and patient safe. We accomplish this by providing our technicians with quality NIST calibrated testing equipment to deliver that assurance.

    ReplyDelete
  6. Thank you for this brief explanation.. it's so useful for me


    hip pain treatment

    ReplyDelete