'Heartbleed': the web's biggest threat

Researchers have disclosed a serious vulnerability in standard web encryption software OpenSSL.

Millions of websites, online stores and social networks are operating with a major security hole in place, exposing user information and financial information to hackers.

That is because a core safety mechanism used to secure the internet has a flaw in it. Worse still, it has been in place for over two years and experts are unsure if it has been exploited for criminal or espionage purposes.

Late on Tuesday, the bombshell hit the web: a Google security engineer and some other researchers published information indicating they had discovered a serious flaw, dubbed "Heartbleed", in numerous but not all versions of the OpenSSL cryptographic software library, which is used to secure millions of websites.

Tech news website The Verge labelled it "the most dangerous security flaw on the web".

Advertisement

"It is catastrophically bad," ICSI security researcher Nicholas Weaver told the website.

Anonymisation software service Tor put it more bluntly: "If you need strong anonymity or privacy on the internet, you might want to stay away from the internet entirely for the next few days "

"This might be a good day to call in sick and take some time to change your passwords everywhere especially your high-security services like email, file storage, and banking, which may have been compromised by this bug," Yahoo's Tumblr said.

"This ... means that the little lock icon (HTTPS) we all trusted to keep our passwords, personal emails, and credit cards safe, was actually making all that private information accessible to anyone who knew about the exploit."

Read the original post:
'Heartbleed': the web's biggest threat