Critical Security Bug 'Heartbleed' Hits Up To 66 Percent Of The Internet

[ashling]

http://www.huffingtonpost.com/2014/04/08/heartbleed-66-percent_n_5112793.html?utm_hp_ref=technology

So what can users do? Matthew Prince, CEO of content delivery network Cloudflare, one of the first businesses to be notified of the bug, told The Huffington Post that sadly, there's not much normal netizens can do to protect themselves. "When you finish using a website, make sure to actively log out," Prince advised -- that makes it less likely that a hacker exploiting Heartbleed will be able to take your personal information.

Prince also put in a word of comfort: "Heartbleed is so serious -- it's such a big, bad event -- that almost every major service is scrambling to clean it up as quickly as possible." He estimated that most currently vulnerable websites will be "patched" by the end of the week.

Though a number of major websites have already been patched, others, including OKCupid, Flickr, Imagur and Yahoo.com, reportedly remain vulnerable to Heartbleed.

Users can test if their favorite websites are vulnerable here, though this service is reportedly not 100 percent reliable. Vulnerable sites should not be logged into until they're patched -- check those sites' blogs or Twitter feeds for updates -- and once a website has its patch in place, you should change your password for that site as soon as possible.

[Erich Bloodaxe BSN]

1. I seem to be good.

The version of openSSL running on my server is not one of the versions listed as being vulnerable to the heartbleed issue, thankfully.

[Warren DeMontague]

2. It's worth noting that it only matters with a site like, say, imgur- if you use a password.

And in that case, the thing to do would be to change it and make sure you're not using the SAME password at other sites.

[ashling]

3. DU password?

Do I need to change my password here?

[ashling]

5. Good to know

When I first heard of this I asked the tech chief at the college where I teach.
They do not use openSSL there either.

[Warren DeMontague]

6. In addition, as to the above: I don't think DU uses encryption, at all.

The difference between an encrypted web connection and a non-encrypted, can be seen in the beginning of the URL; "http" for non, "https" for encrypted.

If security in that regard is a concern to you; like, you're constantly logging in and out of DU and as such sending your password back and forth- you might want to consider using a diff. password for DU than the one you use, for instance, at the bank.



Edited to add: Also probably moot if your DU username isn't related to your bank username, etc.

[Xithras]

7. The impact of HeartBleed is probably being overstated a bit right now.

Heartbleed only impacts Linux based servers running OpenSSL 1.0.0 or 1.0.1. It doesn't impact servers from Microsoft or Sun at all. Linux and Unix servers running OpenSSL competitors such as GnuTLS and JSSE are also not impacted. Also, as 1.0 was a major upgrade and didn't start gaining traction until mid-2012, a vast number of Linux/Apache web servers are still running the older 0.9.8 rev and aren't impacted by this.

When we scanned our datacenter and our clients servers for the vulnerability yesterday, we found that a relatively small percentage of our Linux servers were vulnerable, and all were newer servers implemented in the past 18 months (in fact, all but one were Ubuntu 12.04 LTS installs). The vast majority of our servers were either running 0.9.8 or were running JSSE.