Skip to main content

Here’s how the Heartbleed bug scurried into the hearts and minds of millions

how did the heartbleed openssl bug happen lock

On April 7, 2014, the world learned of what’s possibly the most severe security bug in the history of the Internet. It’s called Heartbleed.

Discovered simultaneously by Neel Mehta, a security researcher at Google, and Finnish security firm Codenomicon, the bug compromises a security protocol commonly used by devices and websites worldwide. Heartbleed makes it possible for a hacker to scrape data from memory – including passwords, bank account numbers, and anything else lingering inside.

The severity of the bug left many wondering how it could happen. OpenSSL, the security protocol in which bug was found, is used all over the world. It’s used not just in servers, but also routers and even some Android smartphones. You might think that some responsible party has a team of security researchers checking and double-checking the code but, in truth, OpenSSL is managed by a small group consisting mostly of volunteers.

Opening to OpenSSL

OpenSSL boasts its open-source origin in its name. Founded in 1998, the project was created to provide a set of free encryption tools for Internet servers. This was an important goal; encryption is critical and common. A free standard was needed to make sure it would be adopted as quickly as possible. The project was wildly successful, and quickly became one of the Internet’s most important security tools.

Yet, success did not result in expansion or profits. OpenSSL generates income only through support contracts, which provides access to troubleshooting and consulting from the organization itself.

A total of just 11 people, most of them volunteers, are responsible for a critical encryption standard.

These contracts provide a minor stream of revenue, but the project is far from being overflowing with cash. The OpenSSL Software Foundation has never earned more than one million dollars in gross annual revenue. Donations have been anemic as well; the organization usually receives about $2,000 each year.

This results in a predictably tiny staff. The “core team” is made up of only four individuals, and the development team adds seven more names to the list. That’s a total of just 11 people, most of them volunteers, responsible for a critical encryption standard. Only one of them, Dr. Stephen Hanson, focuses on OpenSSL entirely. Everyone else has another full-time job.

Steve Marquess, who manages the organization’s money, said it best. “The mystery is not that a few overworked volunteers missed the bug; the mystery is why it hasn’t happened more often.”

Mistakes were made

That’s what the entire crisis boils down to – a mistake. The error was introduced by Robin Seggelmann, a German volunteer working on an OpenSSL extension called Heartbeat. He submitted the code on New Year’s Eve, 2011, and it subsequently slipped through the review process. Heartbleed has existed, unknown to the public, for over two years.

open sslOther members of the project double-check submitted code during the review, but mistakes happen, so it’s hardly a surprise that a bug eventually slipped through. Even multi-billion dollar companies like Microsoft and Cisco are hit by their fair share of embarrassing exploits.

The problem stems from allocating memory according to a value that can be defined by a request. If the user provides a valid input, the function works as intended. However, if an invalid request is made, the code dumps part of what’s in memory, including information that’s supposed to be secure and encrypted. This web comic also explains Heartbleed, should you deem a visualization to be helpful.

Some software engineers believe that the existence of the bug raises questions about the security of C, the code in which the Heartbeat extension was written. Though popular, C is a complex language that offers a lot opportunity for errors in memory management and the handling of values. A bug in another open-source SSL implementation, GnuTLS, cropped up a month before Heartbleed, and was also written in C. That bug was even older; the code responsible for it was added in 2005.

What’s the next step?

Human error is ultimately to blame for Heartbleed, but the fault doesn’t fall solely on the shoulders of a single coder. OpenSSL is free software used by Fortune 500 companies, governments and even military organizations, yet these outfits almost never contribute funding or manpower to the project.

Companies and governments seem very concerned, yet pledges of real support are ominously absent.

That’s a systemic failure on a staggering scale, yet the obvious need for more oversight hasn’t spurred many people in positions of great wealth or power to action. OpenSSL Software Foundation money-man Steve Marquess says that donations have increased since the bug’s discovery, but, as of April 12, still totaled no more than $9,000 for the year. Most of that came from individuals pledging $5 or $10. Companies and governments seem very concerned, yet pledges of real support are ominously absent.

The world also must learn from this mistake. Using an open-source project without contributing to it is, in the long term, a recipe for disaster – particularly when the project is a critical part of network infrastructure. The Internet’s security shouldn’t be upheld by a handful of volunteers who find their names in the news only when something goes wrong.

Editors' Recommendations

Matthew S. Smith
Matthew S. Smith is the former Lead Editor, Reviews at Digital Trends. He previously guided the Products Team, which dives…
Here’s how you can get 2 years of antivirus software for the price of 1
vipre antivirus protection two years for price of one lifestyle

The internet is a fantastic resource of fun memes and useful information, but it can also be a dangerous place for your PC and anything you store on it. That's why it's vital to have antivirus protection installed on your system at all times. Such software can keep an eye out for any potential threats trying to install themselves on your PC before they can do any damage.

Vipre is one of the fastest-growing names out there for antivirus protection and this holiday season, it has a great offer of two years of protection for the price of one. Aimed at providing a great alternative to more traditional and less user-friendly antivirus software, Vipre is affordable, easy to use, and provides award-winning protection. All its support is available right here in the U.S., too, with a great customer service team that is available whenever you need assistance.

Read more
Microsoft opens Chromium Edge bug bounty program with rewards up to $30,000
microsoft chromium edge bug bounty insider

Microsoft has launched a bug bounty program for Chromium Edge, with security starting to become an even more important aspect as the web browser moves closer to its first official release.

Microsoft worked Edge through a major overhaul, dropping EdgeHTML in favor of the open-source Chromium engine that also serves as the foundation for Google's Chrome web browser. To allow the Chromium Edge to keep up with competition, the browsers needs to be proven safe and secure.

Read more
ZombieLoad is Meltdown resurrected. Here’s how to secure your PC right now
Stock photo of Intel 9th gen core processor.

Less than a year and a half since Intel had its first public meltdown after finding the highly publicized Meltdown and Spectre security flaws, researchers have discovered a new security vulnerability called Microarchitectural Data Sampling (MDS) -- which leaves computers dating back to 2008 vulnerable to eavesdropping attacks.

Fortunately, Intel learned its lesson from the first Meltdown discovery, and it finds itself better prepared to address the recently published security flaw that, if unpatched, could leave computers -- ranging from laptops to cloud-based servers -- exposed to eavesdropping by an attacker.
Back from the grave
A series of updates were recently deployed to address the newly uncovered security flaw. Whether you're on a Windows PC or a Mac, you should stay up to date with your security patches to mitigate the risk of attack. Business customers operating their infrastructure from the cloud should check with their service providers to ensure that that latest available security patches will be applied as soon as possible.

Read more