Dangerous new Security Threat: Heartbleed

How would we possibly know if all of the sites we visit have fixed this problem by deploying Fixed OpenSSL? Ebay? Audiogon? Your bank? Amazon? The list goes on and on.

mep said:

How would we possibly know if all of the sites we visit have fixed this problem by deploying Fixed OpenSSL? Ebay? Audiogon? Your bank? Amazon? The list goes on and on.

Click to expand...

My thoughts exactly. Thanks, Gary.

Lee

Thanks, Gary.

Lee

The direct link to the app is https://chrome.google.com/webstore/search/chromebleed

None of the major banking, credit card and travel sites I checked are vulnerable; some also block the heartbeat (in fact, many always did). Chalk another one for a bright Google engineer for discovering this.

garylkoh said:

If you use Chrome, you can install this app which will let you know:
https://chrome.google.com/webstore/detail/chromebleed/eeoekjnjgppnaegdjbcafdggilajhpic

This link tests a server:
http://filippo.io/Heartbleed/

Click to expand...

Thanks for posting that test link. My main financial accounts are unaffected.

Well if you all used a Mac there is no problem whatsoever ......

http://www.macrumors.com/2014/04/10/apple-heartbleed/

garylkoh said:

Not totally true - the iOS and OSX software does not incorporate OpenSSL 1.01, and so are not vulnerable. However, if you installed a browser that used OpenSSL 1.01, you would be vulnerable.

Also, Apple dodged the bullet by being late to the party. iOS incorporates an older version of OpenSSL that was not affected by Heartbleed.

Click to expand...

then it's good to be late to the party

So every single site I use where money is involved apparently doesn't use OpenSSL, and I've gathered that is true generally. Is this really a threat?

rbbert said:

So every single site I use where money is involved apparently doesn't use OpenSSL, and I've gathered that is true generally. Is this really a threat?

Click to expand...

Only if your dumb enough to use the same password at bank of america as on your yahoo account.

garylkoh said:

If you use Chrome, you can install this app which will let you know:
https://chrome.google.com/webstore/detail/chromebleed/eeoekjnjgppnaegdjbcafdggilajhpic

This link tests a server:
http://filippo.io/Heartbleed/

Click to expand...

Thanks Gary.
Very helpful.
Happily all safe.

BTW, when is this site getting a fix?

Great list of sites affected by Heartbleed.....

http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/?utm_cid=mash-com-fb-main-link

Oh yay...our own government got hacked and lost 900 SIN (social security numbers).

http://business.financialpost.com/2014/04/14/cra-sin-stolen-heartbleed/?__lsa=4e1a-0c1e

Millions of Android Phones Could Be Affected by the Heartbleed Bug. Check to See if Yours Is One of Them

Alyssa Bereznak
Tech Columnist
Yahoo

Disturbing news: The now-infamous Heartbleed security flaw might reach further than your favorite websites. It could affect your mobile device, too.

According to an announcement by Google, smartphones and tablets running a specific version of Android were affected by the widespread web security bug, which could potentially spill your sensitive login information (like passwords).

The company assured Android owners in a blog post April 9 that most versions are not affected by the flaw. However, as Bloomberg notes, Google added that a version called 4.1.1 Jelly Bean is a “limited exception.”

That version of Android was released in 2012 and is likely to be running on older Android smartphones. According to the most recent statistics released by Google, about 34 percent of Android devices use a version of the 4.1 Jelly Bean software. Though the company said that fewer than 10 percent of devices in use are vulnerable, a Google spokesperson confirmed to Bloomberg that millions of devices still run 4.1.1 Jelly Bean.

So how can you check to see if your device is affected? You’ll need to go to the Settings menu of your phone and find your way to the About Phone section. There you’ll be able to learn what version of Android you’re running and see if any updates are available.

There’s also a free Android app available that will tell you if your device is vulnerable to the bug.

Whether there is an immediate update to patch this bug is still unclear. Google’s blog post says that “patching information for Android 4.1.1 is being distributed to Android partners.” A Verizon spokesperson told Bloomberg that the company was aware of the “security vulnerability referred to as ‘Heartbleed,’ ” and that the company was “working with our device manufacturers to test and deploy patches to any affected device on our network running Android 4.1.1.”

We’ve reached out to Google for comment. In the meantime, fingers crossed that you’re not affected.

If you need to catch up on which sites are affected by the Heartbleed bug, check out my comprehensive list here.

https://www.yahoo.com/tech/the-heartbleed-aftermath-drags-on-what-passwords-you-82296501283.html

Canadian charged in 'Heartbleed' attack on tax agency

Reuters

OTTAWA, April 16 (Reuters) - Canadian police have arrested a 19-year-old man and charged him in connection with exploiting the "Heartbleed" bug to steal taxpayer data from a government website, the Royal Canadian Mounted Police (RCMP) said on Wednesday.

In what appeared to be the first report of an attack using a flaw in software known as OpenSSL, the Canada Revenue Agency (CRA) said this week that about 900 social insurance numbers and possibly other data had been compromised as a result of an attack on its site.

The suspect, Stephen Solis-Reyes, was arrested at his home in London, Ontario on Wednesday and faces criminal charges of unauthorized use of computer and mischief in relation to data.

"It is believed that Solis-Reyes was able to extract private information held by CRA by exploiting the vulnerability known as the Heartbleed bug," the RCMP said in a statement.

Police seized Solis-Reyes computer equipment and scheduled his court appearance for July 17, 2014.

Internet companies, technology providers, businesses and government agencies have been scrambling to figure out whether their systems are vulnerable to attack since the flaw was disclosed a week ago.

Security experts have warned that more attacks will follow.