Robert Siciliano, an identity-theft expert with Hotspot Shield, explains the Heartbleed bug, which affects an estimated 17 to 20 percent of web servers and can expose usernames, passwords, and credit card numbers. He recommends applying patches, changing passwords, and using a VPN on public Wi-Fi.
Chapters
A major online security breach could be wreaking havoc with your personal information. It's called the Heartbeat Bug. It allows hackers to break into secure communications. The bug can reveal the contents of a server's memory, including private data such as usernames, passwords, and credit card numbers. Joining us from our Beacon Hill studio, Robert Siciliano, identity theft expert with Hotspot Shield. Robert, we appreciate you being here. Thank you. So what websites are we talking about?
Well, we're talking about, uh, 17 to 20% of all web servers connected to the web. That's a pretty big deal. Uh, this could be, you know, any major email provider, any major retailer. Uh, these are, uh, website— or web servers essentially that, uh, function like any other, but they don't have a necessary security patch to protect the user data.
So what's gonna happen if we're going on one of these sites? To our information.
So now that the flaw has been exposed, chances are criminals are ramping up and making efforts to take advantage of this. Now, that also means that IT professionals, you know, the security professionals responsible for downloading and installing the patches necessary to fix it, are probably in a battle. They're in a race to make sure that they do that, they fix it before the bad guys crack it. So over the next coming weeks, we're going to be hearing a lot about this. Meanwhile, consumers need to continually check their accounts looking for unauthorized activity. It'd be a good idea right now to change passwords and then even do it again in a week or two until this goes away.
Because it's interesting you bring up the passwords. We had heard that with this particular bug, that in some cases they were saying not to change your password. But what do you— how's that all work out.
So, you know, advice not to change your password— uh, this— there's never a good reason not to change your password. You know, you can change your password as frequently as you want, as long as you are, um, you know, obviously writing it down, storing it in a safe place, knowing what it is, not forgetting it. So as long as you're doing that, uh, that's a good thing. You know, the researchers, uh, when they exposed it, a lot of the websites that wanted to see if they were infected by it, uh, determined that in fact they were. And they were— they easily were able to scrape their own sites for data. So that's very concerning.
We obviously do so much online, from banking to email to everything, essentially. And then we keep hearing about these bugs. I mean, are we supposed to not do this? I mean, this is the world we live in. So what's the answer if there's going to keep being bugs and hackers that can get into this?
Yeah, you know, just like when you hear of a major automobile manufacturer a manufacturer having a recall on a vehicle, we're still going to drive cars. You know, when computers and technology, they have their flaws, their breaches, we're still going to use it. So it's just a matter of being aware of this stuff, updating your own device's operating system, keeping your antivirus, anti-spyware, anti-phishing, and a firewall always updated, using a virtual private network when you are on free wireless, making sure that you have strong passwords, just maintaining your own security paying attention to existing accounts, looking for unauthorized activity, refuting that in case there is, and getting things like identity theft protection and a credit freeze to protect your identity. Just being security conscious will keep you out of the, out of trouble.
Identity theft expert Robert Siciliano, thanks as always.
