Flaw Found in OpenSSL - the Key Method for Protecting Data on the Internet
Flaw Found in Key Method for Protecting Data on the
Internet
By NICOLE PERLROTH
APRIL 8, 2014, 5:08 PM
On Monday, several security researchers, including from
Google, uncovered a major vulnerability called “Heartbleed” in the technology
that powers encryption across the Internet.
The tiny padlock next to web addresses that promised to
protect our most sensitive information — passwords, stored files, bank details,
even Social Security numbers — is broken.
A flaw has been discovered in one of the Internet’s key
encryption methods, potentially forcing a wide swath of websites to swap out
the virtual keys that generate private connections between the sites and their
customers.
On Tuesday afternoon, many organizations were heeding the
warning. Companies like Lastpass, the password manager, and Tumblr, the social
network owned by Yahoo, said they had issued fixes and warned users to
immediately swap out their usernames and passwords.
The vulnerability involves a serious bug in OpenSSL, the
technology that powers encryption for two-thirds of web servers. It was
revealed Monday by a team of Finnish security researchers who work for
Codenomicon, a security company in Saratoga, Calif., and two security engineers
at Google.
Researchers are calling the bug “Heartbleed” because it
affects the “heartbeat” portion of the OpenSSL protocol, which pings messages
back and forth. It can and has been exploited by attackers.
The bug allows attackers to access the memory on any web
server running OpenSSL and take all sorts of information: customer usernames
and passwords, sensitive banking details, trade secrets and the private
encryption keys that organizations use to communicate privately with their
customers.
What makes the Heartbleed bug particularly severe is that
it can be used by an attacker without leaving any digital crumbs behind.
“It’s a serious bug in that it doesn’t leave any trace,”
said David Chartier, the chief executive at Codenomicon. “Bad guys can access
the memory on a machine and take encryption keys, usernames, passwords,
valuable intellectual property, and there’s no trace they’ve been there.”
Three security researchers at Codenomicon’s offices in
Oulu, Finland, first discovered the bug last Thursday. The researchers, Antti
Karjalainen, Riku Hietamäki and Matti Kamunen, immediately alerted the Finnish
authority that is charged with responsibly disclosing security bugs. As it
turned out, a security researcher at Google, Neel Mehta, had also discovered
the bug and the Google security team had been working on a fix.
On Monday, the open-source team that oversees OpenSSL
issued a warning to people and organizations about the bug, and encouraged
anyone using the OpenSSL library to upgrade to the latest version, which fixes
the problem.
Security researchers say it is impossible to know whether
an attacker used the bug to steal a victim’s information, but found evidence
that attackers were aware of the bug and had been exploiting it. Researchers
monitoring various “honeypots” — stashes of fake data on the web aimed at luring
hackers so researchers can learn more about their tools and techniques — found
evidence that attackers had used the Heartbleed bug to access the fake data.
But actual victims are out of luck. “Unless an attacker
blackmails you, or publishes your information online, or steals a trade secret
and uses it, you won’t know if you’ve been compromised,” Mr. Chartier said.
“That’s what makes it so vicious.”
Security researchers are warning organizations to get new
private encryption keys as quickly as possible, and warning people to start
changing their usernames and passwords immediately, particularly for sensitive
accounts like their online banking, email, file storage and e-commerce
accounts.
“This still means that the little lock icon (HTTPS) we
all trusted to keep our passwords, personal emails, and credit cards safe was
actually making all that private information accessible to anyone who knew
about the exploit,” Tumblr’s security team wrote on their site.
“This might be a good day to call in sick and take some
time to change your passwords everywhere— especially your high-security
services like email, file storage and banking, which may have been compromised
by this bug.”
Mr. Chartier advised users to consider their passwords
gone. “Companies need to get new encryption keys and users need to get new
passwords immediately,” he said. “And do it quickly.”
Comments
Post a Comment