2 min read

Caution Advised as Heartbleed Poses Serious Security Threat

Loredana BOTEZATU

April 10, 2014

Promo Protect all your devices, without slowing them down.
Free 30-day trial
Caution Advised as Heartbleed Poses Serious Security Threat

A potentially damaging flaw has been discovered with the OpenSSL libraries that will likely trigger reactions ranging from mild concern to paranoia. We may never fully know the extent of the damage – or indeed if any damage at all was caused – but Bitdefender advises its customers to exercise caution.

The Heartbleed bug could give anyone who knew about it unfettered access to secure web sites across the internet that use certain versions of OpenSSL, which is used for SSL (Secure Sockets Layer) or TLS (Transport Security Layer) encryption. This means that a thief could enter a secure site, steal sensitive information that everybody thought was secure, and leave without a trace.

The SSL and TLS protocols are used to secure e-mail, web applications, some VPNs, messaging services and more. This means thieves could have made off with encryption keys, private messages, passwords, confidential documents and virtually anything else that users thought was protected.

It is not immediately clear how many people or web sites have been endangered by Heartbleed, but OpenSSL is the default encryption library of Apache and Nginx server software, which are used by 66 percent of the sites in the world, according to the Netcraft April 2014 Web Server Survey.

That doesn’t automatically place them all at risk. The bug is present in versions issued from December 2011 onward. OpenSSL advises in a note that 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. Affected users should upgrade to OpenSSL 1.0.1g.

Yahoo!, Flickr, Wunderlist and other popular services have been vulnerable to the bug and their users may have been affected. Facebook, Google and many of the other most popular destinations on the web, meanwhile, are protected from the Heartbleed bug. However, the risk is high and it is still present.

In the meantime, we advise users to exercise caution even when using sites that they assume to be secure. As always, security on the internet is rarely as certain as users assume.

Note: All product and company names mentioned herein are for identification purposes only and are the property of, and may be trademarks of, their respective owners.

tags


Author


Loredana BOTEZATU

A blend of product manager and journalist with a pinch of e-threat analysis, Loredana writes mostly about malware and spam. She believes that most errors happen between the keyboard and the chair.

View all posts

You might also like

Bookmarks


loader