Posted on 04/11/2014 8:22:27 AM PDT by topher
The cybersecurity firm that discovered the so-called Heartbleed bug, a gaping hole in the most widely used software privacy and security software on the Internet, said the flaw went undetected for two years because of the large amount of intensive work it takes to manually test encryption software.
(Excerpt) Read more at ibtimes.com ...
But does this hole needs to be fixed before changing passwords (changing passwords helps some). But what good if the hole is not fixed?
For your Tech Ping list...
[BBC] Heartbleed bug creates confusion on internet
[Krebs on Security] ‘Heartbleed’ Bug Exposes Passwords, Web Site Encryption Keys
I'm at a total loss to understand what is taking place regarding this hole. Guess I'm just plain stupid but hey I suspected such a long time ago.
[The Blaze] Heartbleed: How the Net Bug That Caught Tech Experts by Surprise Affects You
I think I found some of the answers I sought at my post #5 in your post #6 topher. Thank You.
I think some folks are getting testy in Washington, DC (Fort Meade) about some issues...
Keep the heat on, GOP House!!!
http://money.cnn.com/2014/04/10/technology/security/heartbleed-passwords/index.html
Websites are racing to patch the Heartbleed bug, the worst security hole the Internet has ever seen.
As sites fix the bug on their end, it's time for you to change your passwords. The Heartbleed bug allowed information leaks from a key safety feature that is supposed to keep your online communication private -- email, banking, shopping, and passwords.
Don't change all your passwords yet, though. If a company hasn't yet updated its site, you still can't connect safely. A new password would be compromised too.
Many companies are not informing their customers of the danger -- or asking them to update their log-in credentials. So, here's a handy password list. It'll be updated as companies respond to CNN's questions.
Change these passwords now (they were patched)
•Google, YouTube and Gmail
•Yahoo, Yahoo Mail, Tumblr, Flickr
•OKCupid
•Wikipedia
Don't worry about these (they don't use the affected software, or ran a different version) [I think I will still worry anyway]
•Amazon
•AOL and MapQuest
•Bank of America
•Capital One bank
•Charles Schwab
•Chase bank
•Citibank
•E*Trade
•Fidelity
•HSBC bank
•Microsoft, Hotmail and Outlook
•PayPal
•PNC bank
•Scottrade
•TD Ameritrade
•U.S. Bank
•Vanguard
•Wells Fargo
Don't change these passwords yet (still unclear, no response)
•American Express
•Apple, iCloud and iTunes
You raise an interesting point. If this was undetected for 2 years, why didn’t whoever found it just tell the people who make the software so they could fix it without the bad guys ever knowing that the security problem existed?
“But does this hole needs to be fixed before changing passwords (changing passwords helps some). But what good if the hole is not fixed? “
Correct. Does no good to change until fixed. Plus lots of the really big sites weren’t affected anyway. So you wouldn’t even know where to change.
Not to mention this is all completely hypothetical anyway as there has been no documented case of this exploit being utilized.
Actually, I think “killer computer bug” is a new genre of media alarmism, akin to killer sun spots, the coffee crop will be wiped out, and the chocolate crop will be wiped out. Each of these surfaces in the media every two years like clockwork.
OpenSSL is open source. You can download and go through the tomes of code. Nothing about it is secret.
Changing passwords is futile unless and until the website has patched their OpenSSL servers.
Here’s what most companies, mine included, are doing right now:
1. All certification authorities (CAs) have had their private keys revoked, all certificates issued by the CAs have been revoked, the servers are patched, rebooted, and the private key is reissued.
2. All servers with certificates signed by the CA are deleted from the server certificate store. New certificate signing requests (CSRs) are generated and issued to the CA. The CA signs the new certificate, and the servers are placed back in production.
3. Any servers with self-signed certificates are patched and rebooted. The private keys are deleted and regenerated. Certificates are generated with those keys, and the servers are put back into production.
It’s seems like a minor thing, but if you don’t have the proper infrastructure in place, it could take up to 20 minutes per server. My company alone has over 3,000 servers in production.
Just FYI, OpenSSL is NOT the only player on the market for encryption. Microsoft has its own certificate services. The major public key infrastructure (PKI) players such as VeriSign and Thawte are unaffected, as they have proprietary encryption signing software.
If sites like Amazon, AOL, Fidelity, LinkedIn, etc. show they’re not affected, they’re not affected. They don’t use OpenSSL for encryption.
This is one of those things where you really do get what you paid for.
OpenSSL is open source. Making something like this public to the open source community means it spreads like wildfire and causes panic.
They did the right thing. They found the vulnerability, worked with the key players in the open source community to ensure the patches were pushed to affected platforms, and only after the patch has been pushed to a majority of affected platforms do they go public.
This patch was actually pushed 2 months ago. Since certificates are generated and are generally valid for at least a year and sometimes over 5, there are a lot of vulnerable certificates out there in the wild that were generated with the affected software, thus leaving software vulnerable.
See, just that paragraph which makes complete sense to you might as well be written in Japanese as far as me understanding it.....LOL!
I just posted that article as an explanation to the "illiterate" as it made the most sense to me as to which systems/companys were affected/or not. Sorry if I only added to the confusion.
Thanking Each of You for your responses.
I’m just trying to clarify things for lay people. My personal phone has been vibrating off my desk with calls from friends and family asking if they’re safe.
Encryption is one of those things that most web users just expect to work as intended. When you get into the finer points of it, even security professionals, myself included, have a hard time admitting that it’s foolproof. There’s a LOT that can be screwed up if you don’t know what you’re doing, and on the surface it might look like you’ve configured a perfectly functional secure environment, but to a trained hacker or government operative, you’ve created a honey pot of personal data.
The media is fanning some intense flames on this. I’m trying to throw a little water on to them, because people get worked into a froth over this stuff.
IMO this was not discovered by hackers. If it had been then it would have wound up being overused to the point where security firms would have gone searching for the flaw long ago. It would also have been picked up in short order by white hat guys that run everything that leaves their computers through a filter that looks for suspicious strings
and other things.
It may have been code planted in SSL by an NSA operative working on the open source code though.
Since Snowden, everyone is scrambling to encrypt everything end-to-end. This does not preclude snooping on an individual using a court order but end-to-end encryption for the bulk of net traffic means the end of wholesale snooping on everyone....NSA is saddened, it is what they have long feared.
Now to get real encryption for cell traffic instead of the gov approved weak crypto in use now.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.