Everything You Need to Know About the Heartbleed Bug
The Heartbleed bug is a recently disclosed vulnerability in the commonly used OpenSSL cryptographic technology. The flaw makes it possible to steal the information supposedly protected by the SSL/TLS encryption, which is used for communication security and privacy on the Internet, across a variety of applications including email, instant messaging, and many virtual private networks (VPNs).
Those who exploit the Heartbleed bug can access the memory of systems protected by the vulnerable versions of the encryption software. This gives them access to secret keys that identify service providers and encrypt the traffic, names, and passwords of the users, as well as the actual content. With access to the secret keys, black hat hackers can record communications and steal data in order to impersonate services and users.
Perfect Forward Security Should Minimize Potential Damage
Perfect forward secrecy, or PFS, is an additional layer of security that ensures encryption keys only last for a specified, limited period of time. So even if a hacker did get an encryption key out of a server’s memory, they would only be able to decode secure traffic from that server for a limited period of time. Most major technology firms use PFS, but most midsize and smaller enterprises don’t.
Change Your Passwords
You do need to change your password if you have an account at Google, Yahoo, Facebook or any other web service that uses Open SSL encryption. However, it is important to not change your passwords until you get confirmation from the website that the bug has been successfully patched. That said, most major websites will be patched by now.
Website/App Owners Need to Replace Security Certificate
Web security analysts doing an in-depth analysis of the flaw have determined that all 500,000 affected sites should revoke their security certificates and issue a new certificate to avoid the possibility of phishing. Furthermore, certificate authorities are offering to revoke and reissue security certificates for no charge. There is one problem, however… All these certification revocations are likely to result in slow browsing on the Internet for the next few days
