News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Gartner ranks Druva #1
in overall product rating for
enterprise endpoint backup
for the second year in a row!
You are here: Home / World Wide Web / Systems Still Vulnerable to Heartbleed
Is your endpoint data protected?
Heartbleed Fallout: Thousands of Systems Still Exposed
Heartbleed Fallout: Thousands of Systems Still Exposed
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
JUNE
24
2014


It’s been more than two months since the Heartbleed bug rocked the Internet world. Although some rushed to patch their systems, a new report reveals that many are still vulnerable to what has been called one of the worst-ever vulnerabilities.

First revealed in April, Heartbleed could give hackers access to user passwords and even trick people into using fake versions of popular Web sites. According to the security engineers at Codenomicon who found the bug, the vulnerability is in the OpenSSL cryptographic software library. The weakness, they said, steals information typically protected by the SSL/TLS encryption used to secure the Internet.

“The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software,” according to the Web site dedicated to providing information about the bug. “This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.”

A Decade From Now . . .

Robert Graham, an analyst at advanced persistent cybersecurity solutions Errata Security, is now offering some new facts and figures on Heartbleed. When the vulnerability was announced, the firm found 600,000 systems vulnerable.

“A month later, we found that half had been patched, and only 300k were vulnerable,” Graham wrote in a blog post. “Last night, now slightly over two months after Heartbleed, we scanned again, and found 300k (309,197) still vulnerable. This is done by simply scanning on port 443, I haven't check other ports.”

As Graham sees it, the stats indicate that IT admins have stopped even trying to patch against Heartbleed. He also predicted a slow decrease over the next decade as older systems are slowly replaced.

“Even a decade from now, though, I still expect to find thousands of systems, including critical ones, still vulnerable,” Graham said. “I'll scan again next month, then at the six-month mark, and then yearly after that to track the progress.”

The Long Tail

We caught up with Kasper Lindgaard, Director of Research and Security at information security firm Secunia, to get his take on the latest news. He offered us some stats of his own. To date, he said, Secunia has recorded 590 different products from 100 different vendors as vulnerable thanks to the Heartbleed vulnerability.

“We have written 206 advisories on products affected by Heartbleed. We certainly agree that the patch numbers are leveling out, and while we are waiting for the remaining big vendors to publish the final patches, we don’t expect to see the numbers increase much,” Lindgaard said.

“Quite frankly anyone who hasn’t patched at this stage is not likely to do so now," he added. "There will always be some who fail to apply patches. In any case the vulnerability has a long tail, and the industry must keep vigilant on patching to keep their customers secure.”

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
Protect 100% of your Data The prevalence of laptops and mobile devices in the enterprise makes corporate data increasingly vulnerable to loss and breach. And yet, workforce productivity is now inextricably linked to mobility. Click here to access the white paper "Top 10 Endpoint Backup Mistakes" to learn more about how to confidently protect data across platforms and devices while also providing features designed to enhance the end user experience.
MORE IN WORLD WIDE WEB
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Who Is the Hacker Group Lizard Squad?
Are they dangerous or just obnoxious? That’s what many are wondering about the hacker group Lizard Squad, which tweeted out a bomb threat that grounded a flight with a Sony exec aboard.
 
Are Government Spies Tipping Off Tor?
Less than a month ago, tech news headlines heralded a Tor Project breach. Now, some are saying that government spies are sharing information with Tor to help it prevent future breaches.
 
Backoff Malware Hits 1,000+ Businesses, Likely More
More than 1,000 businesses across the U.S. might have been affected by Backoff, a new kind of point-of-sale (PoS) malware, according to the Department of Homeland Security.
 

Enterprise Hardware Spotlight
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Alert: HP Recalls 5 Million Notebook AC Power Cords
HP is recalling about 5.6 million notebook computer AC power cords in the U.S. and another 446,700 in Canada because of possible overheating, which can pose a fire and burn hazard.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 

Mobile Technology Spotlight
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Verizon Hops on the Voice-Over-LTE Bandwagon
Wireless provider Verizon is gearing up for a nationwide launch of its Voice-over-LTE service over the next several weeks, promising clearer and crisper phone calls and a Skype-like video service.
 
Smartphone 'Kill Switch' Law in California; Will Other States Follow?
California’s new law -- signed by Gov. Jerry Brown on Monday -- aimed at deterring cellphone theft could mean most mobile phones sold in the U.S. will soon include similar “kill-switch” tech.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.