Robert Siciliano explains Heartbleed, an OpenSSL flaw that lets attackers steal passwords from HTTPS sites. Only 17% of web servers have been patched. He recommends changing passwords weekly until sites are fixed, then quarterly or annually after.
Chapters
A number of tech firms have urged people to change all their passwords to protect themselves from a recently discovered computer bug. The Heartbleed bug is a flaw in encryption software known as OpenSSL, which had gone unnoticed for about 2 years. The bug allows hackers to retrieve secret information, including passwords and bank details. OpenSSL is used by around two-thirds of all web servers, but not all are at risk. I'm joined now live from Boston, Massachusetts by Robert Siciliano, a consultant for Hotspot Shield, who's an identity theft expert. Thank you very much indeed for being with us. Give us a bit more of an idea of how this, um, how this bug works, but in layman's terms if you can.
So if you look into the address bar where it says HTTPS, right, that is a signal that it has secure socket layer, essentially means there's encryption there. So websites that serve up the HTTPS generally means that they are secure, that your data is encrypted. However, this bug that has been around for a bit has patches that are available that aren't implemented in as much as 17% of all web servers. So big websites, email servers, even retailers, small businesses that are being hosted by providers that haven't updated this flaw are vulnerable, which means all their data and their customers are vulnerable as well.
So, I mean, who needs to act here? Is the responsibility presumably on these companies, or do— or can users also do something that makes a difference?
So the user, the consumer, the customer, you and I, are at a serious disadvantage here. The battle right now is between the good guys, the IT security professionals, and the bad guys that are now fully aware of this vulnerability to race to either hack it or protect it. So you're gonna see over the next coming weeks Um, many different websites are going to, uh, upgrade and patch this vulnerability, whereas some, um, are gonna be breached. And more than likely, over the coming months, we will find out who in fact, uh, lost this battle and who was breached.
And what about this idea of changing passwords? Is that gonna make a difference, do you think?
So right now, if you go ahead and change passwords, uh, it may mean that you have to go ahead and change them again in a week or two if that particular website has not been properly protected. So it is always a good idea to continually change your passwords at least every quarter to 6 months, at least annually. Right now, it wouldn't be such a bad idea to change them, change them weekly, at least for the next month until it is determined that this patch has been applied. However, you know, you might want to just wait a month. Either way, the most important thing for consumers to do is to pay very close attention to their accounts making sure that there isn't any unauthorized activity.
Okay, on that advice, we'll leave it there. Thank you very much indeed, Robert Siciliano, for talking to us.
