Skip to main content

Here’s how the Heartbleed bug scurried into the hearts and minds of millions

how did the heartbleed openssl bug happen lock
Image used with permission by copyright holder

On April 7, 2014, the world learned of what’s possibly the most severe security bug in the history of the Internet. It’s called Heartbleed.

Discovered simultaneously by Neel Mehta, a security researcher at Google, and Finnish security firm Codenomicon, the bug compromises a security protocol commonly used by devices and websites worldwide. Heartbleed makes it possible for a hacker to scrape data from memory – including passwords, bank account numbers, and anything else lingering inside.

The severity of the bug left many wondering how it could happen. OpenSSL, the security protocol in which bug was found, is used all over the world. It’s used not just in servers, but also routers and even some Android smartphones. You might think that some responsible party has a team of security researchers checking and double-checking the code but, in truth, OpenSSL is managed by a small group consisting mostly of volunteers.

Opening to OpenSSL

OpenSSL boasts its open-source origin in its name. Founded in 1998, the project was created to provide a set of free encryption tools for Internet servers. This was an important goal; encryption is critical and common. A free standard was needed to make sure it would be adopted as quickly as possible. The project was wildly successful, and quickly became one of the Internet’s most important security tools.

Yet, success did not result in expansion or profits. OpenSSL generates income only through support contracts, which provides access to troubleshooting and consulting from the organization itself.

A total of just 11 people, most of them volunteers, are responsible for a critical encryption standard.

These contracts provide a minor stream of revenue, but the project is far from being overflowing with cash. The OpenSSL Software Foundation has never earned more than one million dollars in gross annual revenue. Donations have been anemic as well; the organization usually receives about $2,000 each year.

This results in a predictably tiny staff. The “core team” is made up of only four individuals, and the development team adds seven more names to the list. That’s a total of just 11 people, most of them volunteers, responsible for a critical encryption standard. Only one of them, Dr. Stephen Hanson, focuses on OpenSSL entirely. Everyone else has another full-time job.

Steve Marquess, who manages the organization’s money, said it best. “The mystery is not that a few overworked volunteers missed the bug; the mystery is why it hasn’t happened more often.”

Mistakes were made

That’s what the entire crisis boils down to – a mistake. The error was introduced by Robin Seggelmann, a German volunteer working on an OpenSSL extension called Heartbeat. He submitted the code on New Year’s Eve, 2011, and it subsequently slipped through the review process. Heartbleed has existed, unknown to the public, for over two years.

open sslOther members of the project double-check submitted code during the review, but mistakes happen, so it’s hardly a surprise that a bug eventually slipped through. Even multi-billion dollar companies like Microsoft and Cisco are hit by their fair share of embarrassing exploits.

The problem stems from allocating memory according to a value that can be defined by a request. If the user provides a valid input, the function works as intended. However, if an invalid request is made, the code dumps part of what’s in memory, including information that’s supposed to be secure and encrypted. This web comic also explains Heartbleed, should you deem a visualization to be helpful.

Some software engineers believe that the existence of the bug raises questions about the security of C, the code in which the Heartbeat extension was written. Though popular, C is a complex language that offers a lot opportunity for errors in memory management and the handling of values. A bug in another open-source SSL implementation, GnuTLS, cropped up a month before Heartbleed, and was also written in C. That bug was even older; the code responsible for it was added in 2005.

What’s the next step?

Human error is ultimately to blame for Heartbleed, but the fault doesn’t fall solely on the shoulders of a single coder. OpenSSL is free software used by Fortune 500 companies, governments and even military organizations, yet these outfits almost never contribute funding or manpower to the project.

Companies and governments seem very concerned, yet pledges of real support are ominously absent.

That’s a systemic failure on a staggering scale, yet the obvious need for more oversight hasn’t spurred many people in positions of great wealth or power to action. OpenSSL Software Foundation money-man Steve Marquess says that donations have increased since the bug’s discovery, but, as of April 12, still totaled no more than $9,000 for the year. Most of that came from individuals pledging $5 or $10. Companies and governments seem very concerned, yet pledges of real support are ominously absent.

The world also must learn from this mistake. Using an open-source project without contributing to it is, in the long term, a recipe for disaster – particularly when the project is a critical part of network infrastructure. The Internet’s security shouldn’t be upheld by a handful of volunteers who find their names in the news only when something goes wrong.

Editors' Recommendations

Matthew S. Smith
Matthew S. Smith is the former Lead Editor, Reviews at Digital Trends. He previously guided the Products Team, which dives…
What is a DNS server? Here’s how the Internet serves up your favorites
uk prime minister david cameron announces deal germany develop 5g internet the

Each time you open a browser and type in a web address, there's a hidden hand sending all the information to your PC to render the page as it should. Those middle-men of your newly loaded webpage are the internet's DNS servers.

But what is a DNS server exactly? To help explain, we'll walk you through the process of retrieving a web page and cover the many types of DNS servers residing between you and your favorite sites and services. We'll also show you how to change DNS settings to get the fastest, safest web browsing experience possible.
What is DNS?
DNS is short for Domain Name System. Created in 1983 at the University of Wisconsin, it’s an expanding global directory for the Internet that replaces numeric addresses with alphabetic addresses. Rather than “dial” a string of numbers in a browser to contact Google, just type its name instead. Alphabetic addresses are simply easier to remember, even more so given there are more than 1.7 billion websites on the Internet today.

Read more
Apple finally expands its bug bounty program to accept MacOS bugs
apple macbook pro 16 inch review ry 14

Apple’s 3-year-old bug bounty program has finally, officially expanded to accept bug submissions from other Apple ecosystem platforms, including MacOS. The technology company announced its plans for the expansion just a few months ago, during the Black Hat cybersecurity conference. Apple appears to have launched the expansion of its Security Bounty program on Thursday, December 19, via a new webpage published on its site that provides further details on the updated program.

The Apple Security Bounty program is essentially a program in which Apple incentivizes security researchers to find bugs in Apple’s various operating systems and report them to the company in exchange for a pretty sizable monetary reward. As ZDNet notes, when the program was first launched in 2016, it only accepted bug reports for iOS bugs from certain researchers who had been invited to participate in the program. But as of this week, the Security Bounty program has officially expanded to not only accept MacOS bugs, but also bugs from other Apple operating systems, and it now allows the participation of all security researchers.

Read more
Here’s how you can get 2 years of antivirus software for the price of 1
vipre antivirus protection two years for price of one lifestyle

The internet is a fantastic resource of fun memes and useful information, but it can also be a dangerous place for your PC and anything you store on it. That's why it's vital to have antivirus protection installed on your system at all times. Such software can keep an eye out for any potential threats trying to install themselves on your PC before they can do any damage.

Vipre is one of the fastest-growing names out there for antivirus protection and this holiday season, it has a great offer of two years of protection for the price of one. Aimed at providing a great alternative to more traditional and less user-friendly antivirus software, Vipre is affordable, easy to use, and provides award-winning protection. All its support is available right here in the U.S., too, with a great customer service team that is available whenever you need assistance.

Read more