Robert Siciliano, an identity-theft expert, discusses the Heartbleed OpenSSL vulnerability that exposed millions of passwords and whether the NSA knew about it beforehand. The bug affected nearly two-thirds of the internet's secure servers.
Chapters
The U.S. National Security Agency is denying reports that it knew about the internet bug called Heartbleed. Heartbleed is a glitch in the basic security of websites and affects a popular encryption technology called OpenSSL. That's designed to protect sensitive data like emails, passwords, and even credit card information. When certain website addresses begin with the letters HTTPS accompanied by a closed green padlock, They're supposed to be secure, but Heartbleed creates an opening, making the sites vulnerable to hackers. The flaw has potentially exposed sensitive data in up to two-thirds of the world's websites, and it's believed to have been around for at least two years. It's led Canada to shut down a series of federal websites, as Daniel Lac reports.
More than three-quarters of Canadian taxpayers filed their income tax returns online through the website of the Canada Revenue Agency. But this week, anyone attempting to beat the end of April deadline to file their returns got firsthand experience of the Heartbleed worm. On Wednesday, the agency shut its web file services down, and now the government has suspended internet sites of other departments that use the OpenSSL encryption software. So far, Canada says the closures are a precaution. No security breaches have been detected.— that doesn't mean they haven't happened.
Given the scale and the scope of this vulnerability, it is global. It affects the vast majority of servers on the web around the world. It's only a matter of time before we discover that at least some of them were compromised along the way. The mathematics just— the mathematics absolutely point us in that direction.
The list of well-known internet firms hit by Heartbleed is growing. Google, Facebook, and others say they've fixed the bug. Still others are racing to do so. Canadian and international banks are so far saying they're not affected, but the news that networks and hardware made by Cisco and Juniper could be infected mean this is potentially one of the biggest online security vulnerabilities of all time.
The numbers seem almost too big to believe, but really this is a watershed event in internet security, and I think this is the one, the straw that's going to break the camel's back, force us to finally realize that security, we need to pay a lot more attention to it. We haven't been in the past. That all needs to change and it needs to change now.
Once the sheer size of the problem is determined, the really hard work begins. Finding the breaches that occurred, discovering what data was taken and how it may have been used. We'll be hearing about Heartbleed for weeks, probably months to come. Daniel Lac, Al Jazeera, Toronto.
Robert Siciliano is an identity theft expert at Hotspot Shield. He joins us now from Boston. Welcome. Welcome back to the program. We could first look at what the NSA might or might not know. They've denied knowing anything about the Heartbleed bug. Are you convinced by their denial, or is there something to these reports that they've known about it for at least 2 years?
Well, you know how what they say, when there's smoke, there's fire, and the NSA and others would see a crack in SSL encryption as the key to the kingdom. I mean, this really is the Holy Grail. Uh, for them not to say anything, uh, would be a, uh, huge slap in the face to the, uh, computer security community as well.
Yeah, if they did indeed know about it and perhaps, uh, covered it up to exploit it, is it even ethical? It certainly would upset a lot of people.
Yeah, a lot of people are currently upset that the The rumors are that someone or a group has come forward leaking this. Whether or not it's true, that remains to be seen. Over the coming weeks, whoever it is that has essentially dropped this dime, they're going to need to be revealed. They're going to have to come out in order for the truth to be told.
Hey, Robert, what do you think about what Canada is doing? Is it overreacting by shutting down all its federal websites, or should other governments be following their lead?
Well, it— Canada probably did this due to the fact that they were unpatched and that they are vulnerable. And the smartest thing for them to do, based on the efforts that it would take to secure their technology, their sites, their servers, meant that they did a cost-benefit analysis and decided that now would be a good time to had to shut it down. Other governments and/or retailers' websites might do the same if they face significant risk.
Okay, Robert, one more for you very quickly. How big a threat is this bug to us ordinary folks? Should we be changing our passwords on everything?
So on a scale of 1 to 10, this is an 11. This is a big deal. Consumers It's always a good idea to change your passwords. It is said that, you know, right now might not be the best time because you might have to change it again in a few weeks, but hey, change your passwords now, and if you have to change it again in a few weeks, do so. Monitor your accounts very closely at this point.
Robert, thank you very much indeed. Robert Siciliano is an identity theft expert at Hotspot Shield.
