Here’s how the Heartbleed bug scurried into the hearts and minds of millions

how did the heartbleed openssl bug happen lock

On April 7, 2014, the world learned of what’s possibly the most severe security bug in the history of the Internet. It’s called Heartbleed.

Discovered simultaneously by Neel Mehta, a security researcher at Google, and Finnish security firm Codenomicon, the bug compromises a security protocol commonly used by devices and websites worldwide. Heartbleed makes it possible for a hacker to scrape data from memory – including passwords, bank account numbers, and anything else lingering inside.

The severity of the bug left many wondering how it could happen. OpenSSL, the security protocol in which bug was found, is used all over the world. It’s used not just in servers, but also routers and even some Android smartphones. You might think that some responsible party has a team of security researchers checking and double-checking the code but, in truth, OpenSSL is managed by a small group consisting mostly of volunteers.

Opening to OpenSSL

OpenSSL boasts its open-source origin in its name. Founded in 1998, the project was created to provide a set of free encryption tools for Internet servers. This was an important goal; encryption is critical and common. A free standard was needed to make sure it would be adopted as quickly as possible. The project was wildly successful, and quickly became one of the Internet’s most important security tools.

Yet, success did not result in expansion or profits. OpenSSL generates income only through support contracts, which provides access to troubleshooting and consulting from the organization itself.

A total of just 11 people, most of them volunteers, are responsible for a critical encryption standard.

These contracts provide a minor stream of revenue, but the project is far from being overflowing with cash. The OpenSSL Software Foundation has never earned more than one million dollars in gross annual revenue. Donations have been anemic as well; the organization usually receives about $2,000 each year.

This results in a predictably tiny staff. The “core team” is made up of only four individuals, and the development team adds seven more names to the list. That’s a total of just 11 people, most of them volunteers, responsible for a critical encryption standard. Only one of them, Dr. Stephen Hanson, focuses on OpenSSL entirely. Everyone else has another full-time job.

Steve Marquess, who manages the organization’s money, said it best. “The mystery is not that a few overworked volunteers missed the bug; the mystery is why it hasn’t happened more often.”

Mistakes were made

That’s what the entire crisis boils down to – a mistake. The error was introduced by Robin Seggelmann, a German volunteer working on an OpenSSL extension called Heartbeat. He submitted the code on New Year’s Eve, 2011, and it subsequently slipped through the review process. Heartbleed has existed, unknown to the public, for over two years.

open sslOther members of the project double-check submitted code during the review, but mistakes happen, so it’s hardly a surprise that a bug eventually slipped through. Even multi-billion dollar companies like Microsoft and Cisco are hit by their fair share of embarrassing exploits.

The problem stems from allocating memory according to a value that can be defined by a request. If the user provides a valid input, the function works as intended. However, if an invalid request is made, the code dumps part of what’s in memory, including information that’s supposed to be secure and encrypted. This web comic also explains Heartbleed, should you deem a visualization to be helpful.

Some software engineers believe that the existence of the bug raises questions about the security of C, the code in which the Heartbeat extension was written. Though popular, C is a complex language that offers a lot opportunity for errors in memory management and the handling of values. A bug in another open-source SSL implementation, GnuTLS, cropped up a month before Heartbleed, and was also written in C. That bug was even older; the code responsible for it was added in 2005.

What’s the next step?

Human error is ultimately to blame for Heartbleed, but the fault doesn’t fall solely on the shoulders of a single coder. OpenSSL is free software used by Fortune 500 companies, governments and even military organizations, yet these outfits almost never contribute funding or manpower to the project.

Companies and governments seem very concerned, yet pledges of real support are ominously absent.

That’s a systemic failure on a staggering scale, yet the obvious need for more oversight hasn’t spurred many people in positions of great wealth or power to action. OpenSSL Software Foundation money-man Steve Marquess says that donations have increased since the bug’s discovery, but, as of April 12, still totaled no more than $9,000 for the year. Most of that came from individuals pledging $5 or $10. Companies and governments seem very concerned, yet pledges of real support are ominously absent.

The world also must learn from this mistake. Using an open-source project without contributing to it is, in the long term, a recipe for disaster – particularly when the project is a critical part of network infrastructure. The Internet’s security shouldn’t be upheld by a handful of volunteers who find their names in the news only when something goes wrong.

Product Review

Mediocre battery and a big notch slight Google's otherwise perfect Pixel phone

Google’s Pixel 3 XL has two big flaws: The gigantic notch on the front, and mediocre battery life. That being said, this is the best Android experience you can find in a smartphone today.
Smart Home

Angee’s security service switches from sales to subscriptions

Angee, a successful startup that raised nearly half a million dollars for its home security hub, has pivoted its business model to offer its home security platform as a subscription rather than a smart home product.
Social Media

Tumblr promises it fixed a bug that left user data exposed

A bug on blogging site Tumblr left user data exposed. The company says that once it learned of the flaw, it acted quickly to fix it, adding that it's confident no data linked to its users' accounts was stolen.

Personal info of 30,000-plus Pentagon employees compromised in contractor breach

The Pentagon is facing another security problem after it was discovered that a contractor was responsible for a leak of data that affected more than 30,000 Pentagon employees, both civilian and military.

Will Apple introduce a new MacBook at its Oct. 30 event? Here's everything we know

Whether it's called the MacBook Air or just the MacBook, Apple is highly rumored to introduce a new, affordable laptop in 2018. We discuss reports about upgrading displays, processors, sign-in features, and more.

Apple CEO demands Bloomberg retract its Chinese surveillance story

Apple CEO Tim Cook is calling on Bloomberg to retract a story alleging that Apple had purchased compromised servers that allowed the Chinese government to spy on Apple. Apple's investigation found no truth to the story.
Product Review

Dell’s G3 Gaming laptop knows what gamers want, and what they can live without

Compromise and budget gaming laptops go hand-in-hand, but with the G3, Dell has figured out how to balance what gamers want with what they can live without.
Product Review

Amid a new fleet of budget laptops, the ZenBook 13 sails where others sink

It’s never been truer that you don’t need to spend over a thousand bucks to buy a good laptop. The ZenBook 13 takes we’ve always loved about its predecessor and makes enough small refinements to keep it ahead of its competitors.

Protect your digital identity with these four easy steps to online anonymity

You don't have to be a secret agent or a notorious hacktivist to care about anonymity. Consult this guide to learn tips, tricks, and best practices for staying anonymous and keeping your online activity private

Gaming on a laptop has never been better. These are your best options

Gaming desktops are powerful, but they tie you down to your desk. For those of us who prefer a more mobile experience, here are the best gaming laptops on the market, ranging from budget machines to maxed-out, wallet-emptying PCs.

How does Samsung's new 2-in-1 stack up against the tried-and-true Surface Pro 6?

We're the stacking Surface Pro 6 and Galaxy Book 2 up against each other in this head-to-head. Both of these devices share a similar form factor and design, but be it LTE connectivity or difference in pricing, each offers up its own pros…
Social Media

How to turn off Safe Mode in Tumblr

If you've joined Tumblr after hearing tales about the social network's more adult communities, you may be disappointed by how family-friendly it seems. Here's how to turn off "Safe Search" in Tumblr and delve into the site's seedy…
Product Review

Samsung CHG90 Ultrawide gaming monitor review

Samsung has taken "ultrawide" to its new limit with its 49-inch gaming monitor, the CHG90. With a 144Hz refresh rate and ungodly amounts of screen real estate, it just might be the most impressive gaming monitor ever made.

Choose your weapon wisely -- these are the best keyboards for gaming on your PC

Your PC isn't complete without one of the best gaming keyboards on the planet. We have a list spanning full-sized models to compact versions from Razer, Cooler Master, Corsair, Logitech G, and more.