Search
 

Half-Million Servers Exposed to 'Heartbleed' Cyber Threat

Estimated cost to fix Heartbleed is thousands of dollars per server or application

By staff Writer | Updated on April 11, 2014
The newly exposed Heartbleed bug plaguing some 17% of SSL-secured websites as well as various VPN products has caused a massive case of Internet heartburn over the past 48 hours as companies rushed to confirm their exposure and lock down their SSL/TLS software, writes Kelly Jackson Higgins at InformationWeek. But just how bad is it?

Errata Security CEO Robert Graham scanned the Net for machines vulnerable to the implementation flaw in the so-called Heartbeat function of TLS, and discovered some 600,000 affected out of 28 million SSL machines. He estimates that some one-third of SSL machines had been patched with the update to the buggy OpenSSL library. Netcraft, meanwhile, says the buggy Heartbeat extension is enabled on 17.5 percent of SSL sites, which include close to a half-million digital certificates at risk of theft and spoofing from the attack. 

Bruce Schneier gives Heartbleed an 11 rating on an ascending scale of 1 to 10, and security companies and experts are issuing warnings of the severity of the bug. The flaw, a two-year old implementation bug in the open-source OpenSSL, has been fixed with the new OpenSSL 1.0.1g, but experts say to assume it’s already been abused by nation-states or cyber criminals given the two years it wasn’t publicly known, Jackson Higgins writes.

Want to continue reading?
Become a Free
PropertyCasualty360 Digital Reader.

INCLUDED IN A DIGITAL MEMBERSHIP:

  • All PropertyCasualty360.com news coverage, best practices, and in-depth analysis.
  • Educational webcasts, resources from industry leaders, and informative newsletters.
  • Other award-winning websites including BenefitsPRO.com and ThinkAdvisor.com.

Already have an account?

NOT FOR REPRINT

© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.

Recommended Stories

PropertyCasualty360

Join PropertyCasualty360

Don’t miss crucial news and insights you need to make informed decisions for your P&C insurance business. Join PropertyCasualty360.com now!

  • Unlimited access to PropertyCasualty360.com - your roadmap to thriving in a disrupted environment
  • Access to other award-winning ALM websites including BenefitsPRO.com, ThinkAdvisor.com and Law.com
  • Exclusive discounts on PropertyCasualty360, National Underwriter, Claims and ALM events

Already have an account? Sign In Now
Join PropertyCasualty360

Copyright © 2024 ALM Global, LLC. All Rights Reserved.