It’s been more than two months since the Heartbleed bug rocked the Internet world. Although some rushed to patch their systems, a new report reveals that many are still vulnerable to what has been called one of the worst-ever vulnerabilities.
First revealed in April, Heartbleed could give hackers access to user passwords and even trick people into using fake versions of popular Web sites. According to the security engineers at Codenomicon who found the bug, the vulnerability is in the OpenSSL cryptographic software library. The weakness, they said, steals information typically protected by the SSL/TLS encryption used to secure the Internet.
“The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software,” according to the Web site dedicated to providing information about the bug. “This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal directly from the services and users and to impersonate services and users.”
A Decade From Now . . .
Robert Graham, an analyst at advanced persistent cybersecurity solutions Errata Security, is now offering some new facts and figures on Heartbleed. When the vulnerability was announced, the firm found 600,000 systems vulnerable.
“A month later, we found that half had been patched, and only 300k were vulnerable,” Graham wrote in a blog post. “Last night, now slightly over two months after Heartbleed, we scanned again, and found 300k (309,197) still vulnerable. This is done by simply scanning on port 443, I haven't check other ports.”
As Graham sees it, the stats indicate that IT admins have stopped even trying to patch against Heartbleed. He also predicted a slow decrease over the next decade as older systems are slowly replaced.
“Even a decade from now, though, I still expect to find thousands of systems, including critical ones, still vulnerable,” Graham said. “I'll scan again next month, then at the six-month mark, and then yearly after that to track the progress.”
The Long Tail
We caught up with Kasper Lindgaard, Director of Research and Security at information security firm Secunia, to get his take on the latest news. He offered us some stats of his own. To date, he said, Secunia has recorded 590 different products from 100 different vendors as vulnerable thanks to the Heartbleed vulnerability.
“We have written 206 advisories on products affected by Heartbleed. We certainly agree that the patch numbers are leveling out, and while we are waiting for the remaining big vendors to publish the final patches, we don’t expect to see the numbers increase much,” Lindgaard said.
“Quite frankly anyone who hasn’t patched at this stage is not likely to do so now," he added. "There will always be some who fail to apply patches. In any case the vulnerability has a long tail, and the industry must keep vigilant on patching to keep their customers secure.”