Share this
by Bridget.Giacinto on Apr 17, 2014 9:30:12 AM
The Heartbleed Bug, a newly discovered security bug, poses a major vulnerability to the security of information on the internet. This vulnerability found on OpenSSL software could allow hackers to access the memory of unpatched servers. Since hundreds of thousands of web servers use OpenSSL this is a major security issue that needs to be addressed. In fact, the Heartbleed Bug represents one of the largest security glitches ever discovered in the history of the internet, in that it affects nearly everyone who surfs the web. The breech was publicly announced on April 7, 2014, the same day that the server patch was made available, yet there are still many sites that remain vulnerable. According to NetCraft, an internet security and data mining company, a half million widely trusted websites are vulnerable to the Heartbleed Bug (formerly referred to as CVE-2014-0160, for the line of code containing the glitch).
The Heartbleed Bug allows hackers to access the memory of systems protected by the vulnerable version of the OpenSSL software (versions 1.0.1 through 1.0.1f and 1.0.2-beta). The attacker can grab 64K of memory from the server leaving behind absolutely no trace and it can be done over and over again. Essentially this means that by reading the web server memory, attackers can gain access to personal, sensitive data like passwords, user names, encryption keys and even credit card information from sites you thought were trustworthy.
What is Open SSL?
OpenSSL is an open-source software designed for SSL use across the internet. SSL stands for Secure Sockets Layer (also known by its newer name TLS – Transport Layer Security), which is a cryptographic protocol that makes up a free set of encryption tools that protect information across the internet.
The vulnerability stems from a missing bounds check in the handling of the TSL heartbeat extension. When exploited it leads to the leak of memory contents from the server to the client and from the client to the server.
How Did the Heartbleed Bug Get Its Name?
The term “Heartbleed” was coined by Ossi Herrala, a System Admin at Codenomicon; the same company whose security engineers (Riku, Antti and Matti) discovered the bug (credit was also given to a Google Researcher Neel Mehta who discovered it on the same day). The name was a play on words in that heartbleed was referring to the extension on OpenSSL called “heartbeat.” When referring to the origins of the name, Herrala said it was fitting because it was “bleeding out the important information from the memory.”
How Do I Know if My Favorite Websites are Vulnerable?
CNET has compiled a list of the top 100 sites across the web to make it easier for users to quickly check the status of their favorite sites. This information is hugely important because the last thing you want to do is change your password on a site that hasn’t installed the Heartbleed patch and inadvertently expose your username and password. You can also test the vulnerability of any site using this Heartbleed Vulnerability Tool.
Keep in mind that although not all sites are vulnerable, OpenSSL is the most popular open-source cryptographic library and TLS implementation used to ensure that traffic on the internet is encrypted, so many of your favorite sites are likely to be vulnerable unless they have installed the server patch (OpenSSL 1.0.1g).
Is NovaStor Vulnerable to the Heartbleed Bug?
NovaStor software is not in any way vulnerable to the Heartbleed bug. We did however have one of our many servers that was using an affected version of OpenSSL, although this particular server was not one of our primary web servers and did NOT contain any personal user data or credentials to other servers that include personal user data. Once we learned of the bug our IT team immediately installed the patch so that NovaStor is not in any way vulnerable to the Heartbleed Bug on any of our publicly facing servers.