Heartbleed Bug

Wetin Bleed? *Naija Tone*

In the past few weeks the term Heartbleed has been bundled around and the subject has even been extensively discussed by members of 'the Republic' (#TechRepublic) – Edward Tagoe, Kwabena Akuamoah Boateng , Joseph Dankwah , Jason Derek Bossman , Ethel Cofie , Naa Oyoo Quartey , Macjordan Degajor , Emeka Okoye , Yao Kuwornu and myself. 

The Republic having a selfie time with the US Ambassador to Ghana Gene Cretz

Heartbleed has left people wondering about how much of their data is comprised with some people hastily changing passwords amongst other things. Though changing your password before resolution would not make a user secure.

Heartbleed is not a virus, but rather a mistake written into OpenSSL— open-source software for SSL implementation across the Web.  It is a security vulnerability in OpenSSL software that may affect nearly two-thirds of websites online and allow hackers to access data servers that may contain username, password and other sensitive information.

With the disclosure of a bug in OpenSSL’s implementation of heartbeat, it is no longer necessary for cybercriminals to hack into the server to steal the credentials or private keys. An easy execution of a small code will provide them with wealth of information just by exploiting the vulnerability in OpenSSL. While this is happening, the server admin will never know that their server has been exploited and how much of the information has been leaked by the exploit.

Security researchers found out that an encryption technology SSL/TLS that helps in providing communication security and privacy over the network for various applications viz. web-based applications, email and VPN had this security flaw. This encryption technology that used to safely transmit e-commerce transactions, email, social networking data and other Internet traffic was affected by Heartbleed and this security flaw was enough for hackers to access user’s sensitive personal information.

This vulnerability allows anyone to steal the information which under normal circumstances is protected, by the SSL/TLS encryption. Therefore, attackers can steal a server’s digital key which is used to encrypt data and get easy access to an organization’s sensitive documents.

Security researchers also add that this newly discovered security vulnerability is extremely dangerous as it remained undiscovered for more than two years. However, Wolfgang Kandek, chief technology officer for Redwood City security company Qualys said that, it still remains unclear if hackers have taken advantage of the flaw to steal sensitive data from vulnerable sites.

Organizations such as  Yahoo have come out to declare resolution. However, is it just a publicity stunt to allay fears or they have truly resolved the issue.

Researchers at Codenomicon say that OpenSSL is used by two of the most widely used Web server software, Apache and nginx. This means a lot of internet sites would possibly have this vulnerability.

Wolfgang  Kandek of Redwood City added, many affected websites will now have to have their encryption keys recertified as safe. That’s because even after fixing the flaw in their software, unsafe keys can easily allow hackers to steal sensitive personal information.

Moreover, every website / server / service admin, who uses OpenSSL should be concerned about this vulnerability as it breaks everything for which SSL encryption was deployed in the first place.

So what are the things, a user should consider?

§  Change your passwords only after the affected online service provider has updated their servers in order to compensate for the Heartbleed vulnerability.

§  Services which are affected are ought to be sending emails to users and informing them, that they were affected by Heartbleed and have since updated their servers.

§  Only when you receive this update, change your password, otherwise it will not have the expected outcome.

§  But, if the website has already been compromised, and it is still to fix its software then you should wait to change your password.

• If you are doubtful about a website’s status and whether it is compromised or not, you can go online and check by doing a Heartbleed Vulnerability test

On these sites:

 https://lastpass.com/heartbleed/

https://sslanalyzer.comodoca.com/heartbleed.html

https://pentest-tools.com/vulnerability-scanning/openssl-heartbleed-scanner

            https://www.ssllabs.com/ssltest/index.html

§  As phishing attacks are continuously increasing, some hackers may provide you with links to change your password. To ensure complete safety, manually go to the website yourself, log in and then change your password.

Once you can confirm resolution change your password but ensure that you have a “strong” password, few tips for changing your password:

Never give out your password to anyone (Not even your spouse):

 Never give it to friends, even if they’re really good friends. A friend can – accidentally, we hope – pass your password along to others or even become an ex-friend and abuse it.

Don’t just use one password:

It’s possible that someone working at a site where you use that password could pass it on or use it to break into your accounts at other sites.

Make the password at least 8 characters long: 

The longer the better. Longer passwords are harder for thieves to crack.Include numbers, capital letters and symbols. Consider using a $ instead of an S or a 1 instead of an L, or including an & or % – but note that $1ngle is NOT a good password. Password thieves are onto this. But Mf$1avng (short for “My friend Sam is a very nice guy) is an excellent password.

Create passwords that are easy to remember but hard for others to guess (unique):

When possible, use a phrase such as “I started working in chorkor 1999” and use the initial of each word like this: “IswinC99#!”

Don’t use dictionary words: 

If it’s in the dictionary, there is a chance someone will guess it.  If I am a hacker, I will just write a script to guess dictionary words and common words. Those who like using great, love, sweetheart,heartbeat ,etc. Abeg! That is giving a class 1 assignment to an undergrad student.

Don’t post it in plain sight: 

This might seem obvious but studies have found that a lot of people post their password on their monitor with a sticky note. Bad idea.  If you must write it down, hide the note somewhere where no one can find it. But for God sake, try to keep your password in your head.

Ebei! Is that that difficult? Even after some Bukom Banku beating, you should remember.

Consider using a password manager:

 Programs or Web services like RoboForm (Windows only) or Lastpass (Windows and Mac) let you create a different very strong password for each of your sites. Ultimately, it solves the problem by helping you generate random passwords for each account or site. But you only have to remember the one password to access the program or secure site that stores your passwords for you.

Enable dual-factor authentication: 

Where there is two factor authentication , use it (Gmail is one email service that does so) In addition to a password, the service requests for another identifying information, such as a code that can be sent to you via SMS but if MTN , GLO , TIGO , AIRTEL or VODAFONE decides to screw you , then you are on your own

Credits: Qualys , escan , Efo Koku