HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED 6 MINUTES AGO.
You are here: Home / Customer Data / Systems Still Vulnerable to Heartbleed
Barium Ferrite (BaFe):
Higher Capacity, Superior Performance, Longer Archival Life
www.thefutureoftape.com
Heartbleed Fallout: Thousands of Systems Still Exposed
Heartbleed Fallout: Thousands of Systems Still Exposed
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
JUNE
24
2014


It’s been more than two months since the Heartbleed bug rocked the Internet world. Although some rushed to patch their systems, a new report reveals that many are still vulnerable to what has been called one of the worst-ever vulnerabilities.

First revealed in April, Heartbleed could give hackers access to user passwords and even trick people into using fake versions of popular Web sites. According to the security engineers at Codenomicon who found the bug, the vulnerability is in the OpenSSL cryptographic software library. The weakness, they said, steals information typically protected by the SSL/TLS encryption used to secure the Internet.

“The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software,” according to the Web site dedicated to providing information about the bug. “This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.”

A Decade From Now . . .

Robert Graham, an analyst at advanced persistent cybersecurity solutions Errata Security, is now offering some new facts and figures on Heartbleed. When the vulnerability was announced, the firm found 600,000 systems vulnerable.

“A month later, we found that half had been patched, and only 300k were vulnerable,” Graham wrote in a blog post. “Last night, now slightly over two months after Heartbleed, we scanned again, and found 300k (309,197) still vulnerable. This is done by simply scanning on port 443, I haven't check other ports.”

As Graham sees it, the stats indicate that IT admins have stopped even trying to patch against Heartbleed. He also predicted a slow decrease over the next decade as older systems are slowly replaced.

“Even a decade from now, though, I still expect to find thousands of systems, including critical ones, still vulnerable,” Graham said. “I'll scan again next month, then at the six-month mark, and then yearly after that to track the progress.”

The Long Tail

We caught up with Kasper Lindgaard, Director of Research and Security at information security firm Secunia, to get his take on the latest news. He offered us some stats of his own. To date, he said, Secunia has recorded 590 different products from 100 different vendors as vulnerable thanks to the Heartbleed vulnerability.

“We have written 206 advisories on products affected by Heartbleed. We certainly agree that the patch numbers are leveling out, and while we are waiting for the remaining big vendors to publish the final patches, we don’t expect to see the numbers increase much,” Lindgaard said.

“Quite frankly anyone who hasn’t patched at this stage is not likely to do so now," he added. "There will always be some who fail to apply patches. In any case the vulnerability has a long tail, and the industry must keep vigilant on patching to keep their customers secure.”

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Neustar, Inc. (NYSE: NSR) is a trusted, neutral provider of real-time information and analysis to the Internet, telecommunications, information services, financial services, retail, media and advertising sectors. Neustar applies its advanced, secure technologies in location, identification, and evaluation to help its customers promote and protect their businesses. More information is available at www.neustar.biz.
MORE IN CUSTOMER DATA
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
The FBI is pointing the finger of blame for the Sony Pictures cyberattack directly at North Korea. The hackers stole confidential data and caused the movie giant to can its new comic film, "The Interview."

ENTERPRISE HARDWARE SPOTLIGHT
Almost half of consumer, industry and life sciences manufacturers are expected to be using 3D printers within three years and now 3D printing services are aiming to help companies experiment.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.