Ride the Lightning
Cybersecurity and Future of Law Practice Blog
by Sharon D. Nelson Esq., President of Sensei Enterprises, Inc.
The Heartburn of Heartbleed: What You Need to Know – and Do
April 14, 2014
Heartbleed is bad, but very confusing to most people. As simply as I can put it, it is a bug in OpenSSL, which many server operating systems use to provide Secure Socket Layer functionality.
How many sites are affected? The worst case scenario says that about 2/3 of Internet sites were impacted.
So what does that mean to you? First, do not panic. This bug is not as easy to exploit as some have made out. Still, caution is necessary. First, find out if sites you use are impacted. Google, Facebook and Yahoo were all impacted and have fixed their systems.
That's the critical part: There is no point in changing your password until the systems are fixed – and then, yes, it is time to change your password. CNET has a good list of the top 100 sites which you can check to see if a particular site is patched. Mashable has another list. If you want to learn more, PC World also has a site putting Heartbleed in context and there are FAQs on a New York Times blog.
Because Heartbleed theoretically allows the theft of certificate keys, SSL certificates may have to be regenerated or rekeyed – not to worry, providers will do that. Your part is checking to see which sites you use are affected and changing your password once the vulnerability has been eliminated.
The Heartbleed flaw has been around for at least two years – it was a simple coding error that never got picked up. But boy, has it caused a mess. And how could we have a mess this big without the NSA? Bloomberg reported that at least two sources familiar with the matter said that the NSA had been aware of the bug for at least two years and used it to gather critical information.
Unsurprisingly, the NSA denied the report. Equally unsurprisingly, many people doubted the NSA denial, particularly since there seems to be little question that the NSA is aware of many bugs and has used them to collect intelligence. "Informed sources allege and the NSA denies" is bound to be a recurring theme in our future.
Listen to the Podcast
