×

Warning

JUser: :_load: Unable to load user with ID: 3653
Tuesday, 08 April 2014 14:09

New 'Heartbleed' bug affects encrypted communications Featured

By

A potentially devastating flaw in in OpenSSL, which is used to protect and secure millions of websites, has been uncovered by security researchers.

The flaw, known as “Heartbleed,” is contained in several versions of OpenSSL, a cryptographic library that enables SSL (Secure Sockets Layer) or TLS (Transport Security Layer) encryption.

The flaw, which was introduced in December 2011, has thankfully been fixed in OpenSSL 1.0.1g, which was released on Monday.

More information about the vulnerability is available at a website here, and the vulnerable versions of OpenSSL are 1.0.1 through 1.0.1f with two exceptions: OpenSSL 1.0.0 branch and 0.9.8.

The flaw would potentially allow attackers to monitor all information that flows between a user and a Web service, and could even decrypt past traffic they’ve collected, according to experts.

The bug was discovered by three researchers from security firm Codenomicon and Neel Mehta, a security researcher at Google.

“This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users,” the researchers wrote.

Operating systems that may have a vulnerable version of OpenSSL include Debian Wheezy, Ubuntu 12.04.4 LTS, CentOS 6.5, Fedora 18, OpenBSD 5.3, FreeBSD 8.4, NetBSD 5.0.2 and OpenSUSE 12.2, they wrote.

The programming mistake has left large amounts of private keys and and other secrets exposed to the Internet for a long time, according to Finnish security consultants Codenomicon. Attackers can read the memory of vulnerable systems in 64 kilobyte chunks, until they have the required information to succesfully compromise them.

"You are likely to be affected either directly or indirectly," the researchers said.

"OpenSSL is the most popular open source cryptographic library and TLS (transport layer security) implementation used to encrypt traffic on the Internet.,

"Your popular social site, your company's site, commerce site, hobby site, site you install software from or even sites run by your government might be using vulnerable OpenSSL. Many of online services use TLS to both to identify themselves to you and to protect your privacy and transactions. You might have networked appliances with logins secured by this buggy implementation of the TLS. Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services."

The researchers said the problem, CVE-2014-0160, is a missing bounds check in the handling of the TLS heartbeat extension (hence the name 'Heartbleed'), which can then be used to view 64K of memory on a connected server. This allows attackers to obtain the private keys used to encrypt traffic. 

The attackers can only access 64K of memory during one iteration of the attack, but the attackers can “keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed,” the website said.

The researchers advised administrators to apply the up-to-date version of SSL, revoke any compromised keys and reissue new keys.


Subscribe to ITWIRE UPDATE Newsletter here

GRAND OPENING OF THE ITWIRE SHOP

The much awaited iTWire Shop is now open to our readers.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.

ENTER THE SHOP NOW!

INTRODUCING ITWIRE TV

iTWire TV offers a unique value to the Tech Sector by providing a range of video interviews, news, views and reviews, and also provides the opportunity for vendors to promote your company and your marketing messages.

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the iTWire.com site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.

SEE WHAT'S ON ITWIRE TV NOW!

BACK TO HOME PAGE

Share News tips for the iTWire Journalists? Your tip will be anonymous

WEBINARS ONLINE & ON-DEMAND

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News

Comments