“Heartbleed” Bug – Antibiotics Won’t Help, Changing Passwords Might

By: Michelle Cohen

After recovering from high-profile data breaches at Target and Neiman Marcus, signing up for free credit monitoring and analyzing our credit reports, a new Internet villain recently emerged:  the “Heartbleed Bug.”  The Heartbleed Bug is a security flaw present on Open SSL, popular software run on most webservers.  This open source software is widely used to encrypt web communications.  The Heartbleed Bug affects approximately 500,000 websites, including reportedly Yahoo, OK Cupid, and Tumblr.  And, in addition to websites, the Bug may impact networking devices such as video conferencing services, smartphones, and work phones.

The danger of the Heartbleed Bug lies in its ability to reveal the content of a server’s memory. Then, the Bug can grab sensitive data stored in the memory, including passwords, user names, and credit card numbers.  Adding insult to injury, the Bug has existed for at least two years, giving hackers a huge head start.  News reports and some websites have urged users to change their passwords.  Others have warned individuals not to change their passwords until a website has indicated it has installed the security patch that “cures” the Bug.  Several sites offer tools to “test” whether an indicated website is vulnerable to the Heartbleed Bug, including one by McAfee. In terms of priorities, users should focus on sites where they bank, conduct e-commerce, e-mail and use file storage accounts.

Further intrigue comes from the fact that a recent Bloomberg report alleged that the National Security Agency (“NSA”) knew about the Bug for at least two years, but may have utilized the vulnerabilities to access information.  The NSA has denied it had knowledge of the Bug.

While we have yet to see a “rush to the courthouse” following the announcement of the Heartbleed Bug, we anticipate lawsuits and enforcement could follow where organizations do not act in response to the Bug by installing the necessary security patch.  Companies (including our clients in the Internet marketing and I-gaming industries) should investigate whether their websites, apps, or other services (such as cloud services) use Open SSL – then take immediate efforts to oversee the installation of the security patch.  Organizations should also advise users of the status of the Heartbleed Bug fix and encourage users to change their passwords, with different passwords across different services.