Skip to main content

Heartbleed bug affects ‘almost everyone,’ expert warns

two apple airport base stations were vulnerable to heartbleed but have been patched bug
Image used with permission by copyright holder

Experts say the Heartbleed OpenSSL bug — a flaw in the network software meant to protect your data — may have actually allowed hackers to steal the very data it’s meant to guard. Think you’re safe from this obscure bug in OpenSSL, whatever that is? Think again. One expert noted that “almost everyone” uses it. 

“Given that over half of the world’s webservers use Apache, and Apache uses OpenSSL, the majority of people are using applications built on top of OpenSSL on a regular basis,” explained Steve Pate, the Chief Architect at cloud services company HyTrust.

The Heartbleed bug is a security hole discovered in OpenSSL, widely used network software that encrypts the sensitive data you input into many popular websites. The flaw allows hackers to steal data directly from the memory chips of servers all over the world, and has been in existence for roughly two years. Jean Taggart, a Senior Security Researcher at Malwarebytes, which makes popular anti-malware software, described it as an easy way for crooks to invisibly sweep up your data.

MORE: What is the Heartbleed Bug?

“This vulnerability gives cyber criminals a method for collecting very sensitive information, like private encryption keys. If an adversary has extracted the private key through the Heartbleed vulnerability, they can impersonate the victim, and set up an undetectable man-in-the-middle attack,” Taggart said.

OpenSSL has a history of being vulnerable to attacks, Pate says, with the first flaw spotted by HyTrust back in May of 2009. However, Pate also notes that though OpenSSL 1.0.1 and 1.0.2-beta already have Heartbleed bug fixes available, if the affected versions are being used, the exploit may have already been used by hackers to swipe sensitive data.

 Taggart also explained that exterminating the security flaw will be no easy task.

“Fixing this bug will not be trivial, because even though security professionals can roll out an upgrade, many will not reset their certificates as this is a difficult and lengthy task. So if they were compromised prior to the announcement of the bug, their private keys might already be in the hands of adversaries, and their encrypted communications could be intercepted by third parties.”

MORE: Which websites are affected by the Heartbleed Bug?

Nathaniel Couper-Noles, a Principal Security Consultant at security firm Neohapsis, said that though there are workarounds and fixes available to combat Heartbleed, “the horse may already be out of the barn.”

“Many organizations aren’t instrumented to identify whether and where they’re vulnerable, the attack may leave no footprint discernable from legitimate traffic, and the consequences can potentially be long term,” Couper-Noles said. On top of that, Couper-Noles noted that there could be “hundreds or thousands of affected systems” across the world’s businesses.

At this point, changing your passwords is the best course of action you can take to protect yourself from the Heartbleed bug. On top of that, avoiding the webpages on this list of sites that are allegedly affected by the OpenSSL flaw is also highly recommended.

Image credit: http://www.wallpaperzzz.com

Editors' Recommendations

Konrad Krawczyk
Former Digital Trends Contributor
Konrad covers desktops, laptops, tablets, sports tech and subjects in between for Digital Trends. Prior to joining DT, he…
Meta’s AI smart glasses collection can live stream video — but they’re missing a big feature
Ray-Ban Meta smart glasses in Headline style are worn by a model.

Ray-Ban Meta smart glasses shown in hand at the Meta event. Fionna Agomuoh / Digital Trends

Meta just announced its second-generation smart glasses, once again partnering with Ray-Ban to add more style to this collection of tech-enhanced glasses and shades. The headline feature is the ability to livestream video directly to Instagram and Facebook, but unlike some more premium options, the frames don't include displays for a mixed reality experience.

Read more
How to preorder the Meta Quest 3
Meta Quest 3 sitting on a display table.

Meta's Quest 3 is official, and it's arriving soon. The VR headset is sure to be in high demand when it releases on October 10, so you'll want to secure a Meta Quest 3 preorder if you want to be among the first to use the headset.

Some listings are already live, so in this guide, we'll show you how to preorder the Meta Quest 3.

Read more
Meta just created a Snoop Dogg AI for your text RPGs
Meta AI's Dungeon Master looks like Snoop Dogg.

Meta Connect started with the Quest 3 announcement but that’s not the only big news. The metaverse company is also a leader in AI and has released several valuable models to the open-source community. Today, Meta announced its generative AI is coming soon to its social media apps, and it looks both fun and useful.
Meta AI for text
When CEO Mark Zuckerberg announced Meta AI for social media, it seemed interesting. When one of the custom AIs looked like Snoop Dogg wearing Dungeons and Dragons gear, there was a gasp from the live audience, followed by whoops of joy and applause.

Meta AI's Dungeon Master looks like Snoop Dogg. Meta

Read more