Tag: Heartbleed

As companies scrambled in recent days to address the latest cybersecurity bug known as Heartbleed, researchers at The University of Texas at Dallas had a solution that fixes the vulnerability, and also detects and entraps hackers who might be using it to steal sensitive data.

The advanced technique — dubbed Red Herring — was created by a team led by Dr. Kevin Hamlen, an associate professor of computer science in the Erik Jonsson School of Computer Science and Engineering. It automates the process of creating decoy servers, making hackers believe they have gained access to confidential, secure information, when in fact their deeds are being monitored, analyzed and traced back to the source.

“Our automated honeypot creates a fixed Web server that looks and acts exactly like the original — but it’s a trap,” said Hamlen, a member of the UT Dallas Cyber Security Research and Education Institute (CSI). “The attackers think they are winning, but Red Herring basically keeps them on the hook longer so the server owner can track them and their activities. This is a way to discover what these nefarious individuals are trying to do, instead of just blocking what they are doing.”

via Cybersecurity Researchers Roll Out A New Heartbleed Solution – News Center – The University of Texas at Dallas.

Efforts to fix the notorious Heartbleed bug threaten to cause major disruptions to the Internet over the next several weeks as companies scramble to repair encryption systems on hundreds of thousands of Web sites at the same time, security experts say.

Estimates of the severity of the bug’s damage have mounted almost daily since researchers announced the discovery of Heartbleed last week. What initially seemed like an inconvenient matter of changing passwords for protection now appears much more serious. New revelations suggest that skilled hackers can use the bug to create fake Web sites that mimic legitimate ones to trick consumers into handing over valuable personal information.

The sheer scale of the work required to fix this aspect of the bug — which makes it possible to steal the “security certificates” that verify that a Web site is authentic — could overwhelm the systems designed to keep the Internet trustworthy.

via Heartbleed is about to get worse, and it will slow the Internet to a crawl.

The encryption flaw that punctured the heart of the Internet this week underscores a weakness in Internet security: A good chunk of it is managed by four European coders and a former military consultant in Maryland.

Most of the 11-member team are volunteers; only one works full time. Their budget is less than $1 million a year. The Heartbleed bug, revealed Monday, was the product of a fluke introduced by a young German researcher.

via Heartbleed Bug’s ‘Voluntary’ Origins – WSJ.com.

Hackers could crack email systems, security firewalls and possibly mobile phones through the “Heartbleed” computer bug, according to security experts who warned on Thursday that the risks extended beyond just Internet Web servers.

The widespread bug surfaced late on Monday, when it was disclosed that a pernicious flaw in a widely used Web encryption program known as OpenSSL opened hundreds of thousands of websites to data theft. Developers rushed out patches to fix affected web servers when they disclosed the problem, which affected companies from Amazon.com Inc and Google Inc to Yahoo Inc.

Yet pieces of vulnerable OpenSSL code can be found inside plenty of other places, including email servers, ordinary PCs, phones and even security products such as firewalls. Developers of those products are scrambling to figure out whether they are vulnerable and patch them to keep their users safe.

via ‘Heartbleed’ computer bug threat spreads to firewalls and beyond | Reuters.

The Canada Revenue Agency has shut down public access to its electronic services website over security concerns related to the “Heartbleed Bug,” a newly discovered software flaw that has made information on many of the world’s major websites vulnerable to theft.

In a message posted on its website, the agency said that it had temporarily closed its services site “to protect the security of taxpayer information.”

Revenue Minister Kerry-Lynne Findlay said Wednesday morning that the site had been closed as a “precautionary measure.”

via Can’t file your taxes? Canada Revenue Agency services website shut down over security concerns | CTV News.

A newly discovered security bug nicknamed Heartbleed has exposed millions of usernames, passwords and reportedly credit card numbers — a major problem that hackers could have exploited during the more than two years it went undetected.

It’s unlike most of the breaches reported over the past few years, in which one Web site or another got hacked or let its guard down. The flaw this time is in code designed to keep servers secure — tens of thousands of servers on which data is stored for thousands of sites.

via Major bug called ‘Heartbleed’ exposes Internet data.