Connect with us

Hi, what are you looking for?

World

‘Heartbleed’ bug puts encrypted data in danger

-

Trust in the Internet took a major blow as alarm spread that software commonly used to encrypt and secure online transactions could wind up giving away the store.

Computer security specialists, website masters, and fans of online privacy were worriedly abuzz with word of a freshly-discovered flaw in online data-scrambling software that hackers can turn to their advantage.

A bug dubbed "Heartbleed" in OpenSSL encryption software lets attackers illicitly retrieve passwords and other bits of information from working memory on computer servers, according to cyber-defense specialists at Fox-IT.

"Expect everybody who runs an https web server to be scrambling today," the Tor Project said in a warning posted at its website.

"If you need strong anonymity or privacy on the Internet, you might want to stay away from the Internet entirely for the next few days while things settle," it said.

OpenSSL is used to protect passwords, credit card numbers and other data coursing through the Internet.

-Crown jewels at risk -

Information considered at risk includes source codes, passwords, and "keys" that could be used to impersonate websites or unlock encrypted data.

"These are the crown jewels, the encryption keys themselves," said a website devoted to details of the vulnerability.

"Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will."

The flaw in OpenSSL essentially allows a hacker to read the memory of a machine working the software, but no more than 64 kilobytes of data at a time, according to security specialists.

Nor can hackers control which bits of memory are tapped, leaving to chance what they get their hands on.

However, hackers could repeatedly grab packets of memory to ramp up the odds of stealing valuable data.

"There is no limit on the number of attacks that can be performed," Fox-IT said in a blog post that listed steps business IT handlers can take to thwart incursions.

Security researchers reported being able to dig out Yahoo password information by taking advantage of the bug. Yahoo released a statement Tuesday saying it had fixed the problem at its main online properties.

Fox-IT estimated that the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.

OpenSSL is used by more than half of websites, but not all versions have the vulnerability, according to heartbleed.com.

The group behind open-source OpenSSL put out a security alert urging users to upgrade to an improved version of the software and gave credit for finding the bug to Neel Mehta of Google Security.

- Website impersonators -

While it is not yet known whether hackers have exploited Heartbleed, operators of websites that used vulnerable version of OpenSSL need to switch to secure versions.

By late Tuesday, software patches and updates were being rushed out.

Websites will also need to change credentials used to verify authenticity in order to prevent hackers who may have looted the data from impersonating legitimate online venues and tricking visitors to enter valuable personal information.

As an added precaution, Internet users were advised to change passwords to online accounts or services they are intent on protecting.

OpenSSL shot to one of the hottest topics at Twitter.

"Shaking my head over recommendation to change passwords everywhere due to Heartbleed," Twitter @agentK said in message.

"If the service hasn't fixed OpenSSL, hardly worth it."

  1. heartbleed.com

Trust in the Internet took a major blow as alarm spread that software commonly used to encrypt and secure online transactions could wind up giving away the store.

Computer security specialists, website masters, and fans of online privacy were worriedly abuzz with word of a freshly-discovered flaw in online data-scrambling software that hackers can turn to their advantage.

A bug dubbed “Heartbleed” in OpenSSL encryption software lets attackers illicitly retrieve passwords and other bits of information from working memory on computer servers, according to cyber-defense specialists at Fox-IT.

“Expect everybody who runs an https web server to be scrambling today,” the Tor Project said in a warning posted at its website.

“If you need strong anonymity or privacy on the Internet, you might want to stay away from the Internet entirely for the next few days while things settle,” it said.

OpenSSL is used to protect passwords, credit card numbers and other data coursing through the Internet.

-Crown jewels at risk –

Information considered at risk includes source codes, passwords, and “keys” that could be used to impersonate websites or unlock encrypted data.

“These are the crown jewels, the encryption keys themselves,” said a website devoted to details of the vulnerability.

“Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will.”

The flaw in OpenSSL essentially allows a hacker to read the memory of a machine working the software, but no more than 64 kilobytes of data at a time, according to security specialists.

Nor can hackers control which bits of memory are tapped, leaving to chance what they get their hands on.

However, hackers could repeatedly grab packets of memory to ramp up the odds of stealing valuable data.

“There is no limit on the number of attacks that can be performed,” Fox-IT said in a blog post that listed steps business IT handlers can take to thwart incursions.

Security researchers reported being able to dig out Yahoo password information by taking advantage of the bug. Yahoo released a statement Tuesday saying it had fixed the problem at its main online properties.

Fox-IT estimated that the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.

OpenSSL is used by more than half of websites, but not all versions have the vulnerability, according to heartbleed.com.

The group behind open-source OpenSSL put out a security alert urging users to upgrade to an improved version of the software and gave credit for finding the bug to Neel Mehta of Google Security.

– Website impersonators –

While it is not yet known whether hackers have exploited Heartbleed, operators of websites that used vulnerable version of OpenSSL need to switch to secure versions.

By late Tuesday, software patches and updates were being rushed out.

Websites will also need to change credentials used to verify authenticity in order to prevent hackers who may have looted the data from impersonating legitimate online venues and tricking visitors to enter valuable personal information.

As an added precaution, Internet users were advised to change passwords to online accounts or services they are intent on protecting.

OpenSSL shot to one of the hottest topics at Twitter.

“Shaking my head over recommendation to change passwords everywhere due to Heartbleed,” Twitter @agentK said in message.

“If the service hasn’t fixed OpenSSL, hardly worth it.”

  1. heartbleed.com
AFP
Written By

With 2,400 staff representing 100 different nationalities, AFP covers the world as a leading global news agency. AFP provides fast, comprehensive and verified coverage of the issues affecting our daily lives.

You may also like:

Entertainment

Academy Award nominee Cynthia Erivo has been taking the entertainment industry by storm thanks to her acting work in the film "Wicked," where she...

Business

The Government of Alberta today introduced a strategy to establish itself as North America's premier destination for AI data centres.

Business

Alberta government juggles needs of AI data centre infrastructure while maintaining energy stability and affordability.

Business

The nod could spark questions about potential conflicts of interest, given Isaacman's extensive financial ties to Elon Musk.