How To Beat the Heartbleed Bug

Heartbleed headlines continue this week as IT admins scramble for answers no one has. Early reports of stolen personal information -- including 900 social insurance numbers in Canada -- are starting to trickle in.

Indeed, the recent discovery of Heartbleed has thrown information security professionals into a tizzy and we may not have seen the worst of it yet. This could be the zero day bug to end all zero day bugs -- at least until the next one.

Security engineers at Codenomicon who found the bug are reporting that the vulnerability is in the OpenSSL cryptographic software library. The weakness, they said, steals information typically protected by the SSL/TLS encryption used to secure the Internet. Current reports suggest up to 60 percent of Web servers could be impacted.

The Canada Revenue Agency said the data was stolen from its systems, which were left vulnerable by the Heartbleed bug, according to reports. The agency said it blocked public access to its online services for several days last week until it addressed the security risk, but despite that measure, a data breach occurred over a six-hour period.

Miles To Go

We caught up with Mark Gazit, CEO of ThetaRay and one of IsraelEUs sharpest cybersecurity professionals, to get his take on the issue. He told us experts are still looking for ways to patch Heartbleed before malicious actors heavily exploit it. Some advisories are telling organizations to EUassume the worst has already happened,EU preparing teams to move to detection and post-breach response plans, he noted.

EUThe immediate thought on everyoneEUs mind is that when there is a bug, there is a patch, and the first thing to do is apply it to stop the bleeding,EU Gazit said. EUAlthough this may appear to be a solution and a way of allaying the panic, applying patches to the many...

Comments are closed.