Heartbleed Bleeds On

Jul 29, 2014

According to a report, many potential victims of the Heartbleed attack have patched their systems, but few have cleaned up the crime scene to protect themselves from the effects of a previous intrusion.

The recent Heartbleed scare revealed that millions of servers around the world were vulnerable to an SSL-based attack that could compromise private keys and thus allow an intruder to break into supposedly encrypted and secure Internet services. Heartbleed was widely reported and was considered a wake-up call for software developers, webmasters, and security specialists to get serious about fixing broken software and keeping systems up to date.
But according to a study by Venafi Labs, the Heartbleed cleanup remains unfinished. The study investigated servers for 1,639 companies around the world and found that 99% had checked and patched the actual Heartbleed flaw, but only 3% had made the effort to change their original private key. If any of these servers using the previous private key were subject to a Heartbleed attack prior to the patch, they are still vulnerable.
In an interview with The Register, Venafi VP Kevin Bocek explains, “Mopping up after an incident isn’t as simple as it used to be …. You can’t just stick a patch on it and call it done.”

Related content

  • Linux News

    Updates on Technologies, Trends, and Tools

  • New Attack Targets Wireless Logins

    A first cousin of the recent Heartbleed attack affects EAP-based wireless and peer-to-peer authentication.

  • Cisco Releases Annual Security Report

    Spammers go low-volume, and 90% of IE browsers are unpatched.

  • Ask Klaus!
  • Welcome

    The Linux Foundation launched the Core Infrastructure Initiative (CII) as a bold stroke in 2014. The foundation, which stands astride the FOSS world and mediates between the realm of business and the hacker culture, started the CII as a reaction to the infamous Heartbleed bug, which shocked the open source faithful and left doubts about the security of FOSS technologies. The original goal of the CII was to "fund and support critical elements of the global information infrastructure," which sounded like a good idea. I didn't have high hopes for them doing much besides giving out money, but money is always good. In the business world, where the Linux Foundation keeps one foot, if you can't make a problem go away by denying it, the next best thing is to pounce on it dramatically and say, "We've got this under control!"

comments powered by Disqus

Issue 28: GIMP Handbook 4th Ed./Special Editions

Buy this issue as a PDF

Digital Issue: Price $15.99
(incl. VAT)