Heartbleed: The Inside Story for @HotspotShield

By now you've heard about the Heartbleed bug, but do you really know what it is and how to fight it off? Back away from the keyboard. It's the Inside Story. Hello, I'm Ray Suarez. Just in the past several days, millions of you have heard that the bad guys, the vandals, the thieves may have burrowed into the world of online commerce, intruding on the back-and-forth conversations between your computer and your email servers, between you and the places you buy things online. It's not completely clear what's happened as a result, But are you as blithely confident about logging on to a sales site to see where your package is as you were a couple of weeks ago? And the web has been full of conflicting information in the last few days. Change your password? No, not until you're sure the site has fixed its security settings. Or change your password? Sure, any sales site worth its salt has already fixed this thing. Well, what are you supposed to do? I don't know, but we're gonna find out. Joining us to help you understand how this latest vulnerability might end in an effort to pick your pocket, how to protect yourself, and the possible costs to the fast-growing world of selling and services on the web, we're joined by Yan Zhu, a staff technologist with the Electronic Frontier Foundation. She writes code with a focus on encryption and privacy for internet users. Yan joins us from San Francisco. From Boston, Robert Siciliano, an expert in identity theft with with Hotspot Shield, a product that protects online communications. And from New York, Christina Warren, senior tech analyst with Mashable. Robert Siciliano, how was this problem detected in the first place then?

So, uh, researchers, um, were able to, uh, detect it, uh, by looking at it essentially. Uh, they, uh, found it, I'm sure it was a eureka moment, and then they quickly disclosed it, uh, and here we are in the midst of, uh, what, what would be one of the largest security crisis with the internet thus far.

So disclosed it, but that means disclosed it to the users and potential criminals at the same time.

Well, that's kinda how these things go, you know, when you make the public aware of it, of course you can be making the bad guys aware of it too. But with most flaws, most vulnerabilities, If the researchers have an opportunity to contact, say, an individual company, then they will, depending on the nature of the hacker, whether they're black hat or gray hat or white hat. They may or may not disclose it publicly. They might go right to the company. In this case, they didn't have much of a choice. It had to be public because of how many were affected by it.

So Robert, what could people with bad intent do in that little space between the time the word goes out that this problem exists and everybody fixes it.

So they'll go to, uh, whatever sites they determine are not properly protected, and, uh, they'll begin to essentially sniff in, uh, become a middleman in regards to the communications. Uh, they will in some cases extract usernames and passwords, whatever sensitive data is being passed from the user through the website, and like they have done in Canada, they were able to get, uh, looks like almost 1,000 social insurance numbers from Canadian taxpayers, and then they use that data to commit fraud. They will open up new lines of credit, they'll take over existing accounts with the usernames and passwords. So the idea behind the S at the end of HTTPS is security, encryption essentially, to protect that information. But when the door's not locked, it allows the bad guy to get in. And in this case, it gives the bad guy access to vast amounts of personal information. And more than likely, that has occurred multiple times, and those that have been affected might not find out for days, weeks, months, or years for that matter. And it's very possible that they have been affected in the past and they will only begin to realize it, uh, in the future.

Robert, why do you have to change them all? And why do you have to, um, go to places that you don't use as often or go to places where you haven't signed on in a long time and change the passwords even there?

So the idea behind changing a password has been around for quite some time aside from this particular issue. You should change your passwords periodically, at least semi-annually, if not annually. Most corporations that have sensitive data require their employees to change them quarterly. That's always a good practice to get into, you know, uppercase, lowercase, characters, numbers, and so forth. By changing your passwords, you make it a little more difficult for a criminal to access your accounts, as long as they're what's considered a strong password. For your most critical accounts, you should be changing your passwords rather frequently. When I say that, you know, quarterly, semi-annually, and so forth. And then for the ancillary accounts that you may never visit, it may not be necessary to change those passwords if you're not going to them and if there's no sensitive data on them. The idea is your most critical accounts. For example, email is a critical account. It is, you know, an axiom in the security industry is, you know, for the bad guy to own the email, the bad guy owns the person. So email is critical. You want to change that. And then, you know, banking and so forth, even social. And the reason why these accounts are considered critical is because, again, they have access to personal information, they have access to your contacts, and all that data can be compromised and those contacts can be socially engineered. And having different passwords, like was already said, is essential as well, because having the same password across accounts makes it very easy for the hacker to get into additional accounts.

Robert, this is only the latest in a long line of stories of this kind where information is stolen— sensitive, important, valuable information is stolen. Does this have the possible consequences of really hurting the advancement of online commerce?

So I think, um, in the long run it will help. I think it'll give, um, the, uh, both the government and the security community a heads up that, uh, we need to take things a bit more seriously. Certainly open source has been a great way to get things done, but, uh, there needs to be some more oversight, additional administration to make sure that something like this doesn't happen again. Certainly, you know, there has been a battle ensued over the past two decades, essentially, between good and evil, good guys and bad guys, white hats and black hats, to race towards, you know, keeping the net secure or wreaking havoc in compromising data and stealing identities. And that is never going to stop. I mean, it's always going to be like that. But when you have, you know, vulnerabilities like this that is, you know, no fault of a bad guy, it definitely makes the entire internet community pause and to reevaluate and say, okay, so what do we have to do in the future so that it doesn't happen again?

Thanks to everybody for joining us for this edition. That brings us to the end of Inside Story. Thanks for being with us. Now, the program may be over, but the conversation continues. We want to hear what you think about the issues on this or any day's show. You can log on to our Facebook page where you've changed your password, or you can send us your thoughts on Twitter. Our handle is @ajinsidestoryam, or you can reach me directly @RaySuarezNews. See you for the next Inside Story in Washington.