Public Urged to Reset All Passwords- OpenSSL Compromised

House · Apr 10, 2014

Time to change from 'password' to '12345678' or vice versa

Heartbleed Bug has been detected

Several tech firms are urging people to change all their passwords after the discovery of a major security flaw.

The Yahoo blogging platform Tumblr has advised the public to "change your passwords everywhere - especially your high-security services like email, file storage and banking". Security advisers have given similar warnings about the Heartbleed Bug.

It follows news that a product used to safeguard data could be compromised to allow eavesdropping.

OpenSSL is a popular cryptographic library used to digitally scramble sensitive data as it passes to and from computer servers so that only the service provider and the intended recipients can make sense of it.

If an organisation employs OpenSSL, users see a padlock icon in their web browser - although this can also be triggered by rival products.

Those affected include Canada's tax collecting agency, which halted online services "to safeguard the integrity of the information we hold".

Google Security and Codenomicon - a Finnish security company - revealed on Monday that a flaw had existed in OpenSSL for more than two years that could be used to expose the secret keys that identify service providers employing the code.

They said that if attackers made copies of these keys they could steal the names and passwords of people using the services, as well as take copies of their data and set up spoof sites that would appear legitimate because they used the stolen credentials.

The University of Surrey's Prof Alan Woodward is among security experts to have suggested internet users should now update their login details.

It is not known whether the exploit had been used before the revelation, since doing so would not leave a trail - unless the hackers published their haul online.

"If people have logged into a service during the window of vulnerability then there is a chance that the password is already harvested," said Ari Takanen, Codenomicon's chief technology officer.
Click to expand...

Better safe than sorry...

"I think there is a low to medium risk that any given password has been compromised," said Dr Steven Murdoch.

"It's not the same as previous breaches where there's been confirmed password lists posted to the internet. It's not as urgent as that.
Click to expand...

BBC

BullionDollarMan · Apr 15, 2014

Thanks House,
Also found this information:

http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/

Video at the end explains it well.

steve.rsa · Apr 15, 2014

steve.rsa · Apr 15, 2014

Test your sites on this : https://www.ssllabs.com/ssltest/index.html

Log in or Sign up

Public Urged to Reset All Passwords- OpenSSL Compromised

House Well-Known Member Silver Stacker

BullionDollarMan Member Silver Stacker

steve.rsa Member Silver Stacker

steve.rsa Member Silver Stacker

Share This Page

Log in or Sign up

Public Urged to Reset All Passwords- OpenSSL Compromised

House Well-Known Member Silver Stacker

BullionDollarMan Member Silver Stacker

steve.rsa Member Silver Stacker

steve.rsa Member Silver Stacker

Share This Page

Useful Searches