Slashdot Mirror
Over 300,000 Servers Remain Vulnerable To Heartbleed
An anonymous reader writes Even though it's been a couple months since the Heartbleed bug was discovered, many servers remain unpatched and vulnerable. "Two months ago, security experts and web users panicked when a Google engineer discovered a major bug — known as Heartbleed — that put over a million web servers at risk. The bug doesn't make the news much anymore, but that doesn't mean the problem's solved. Security researcher Robert David Graham has found that at least 309,197 servers are still vulnerable to the exploit. Immediately after the announcement, Graham found some 600,000 servers were exposed by Heartbleed. One month after the bug was announced, that number dropped down to 318,239. In the past month, however, only 9,042 of those servers have been patched to block Heartbleed. That's cause for concern, because it means that smaller sites aren't making the effort to implement a fix."
If those servers would have studied engineering instead of history, they probably would not be servers and not be suffering from broken hearts.
Time Bomber the Book coming soon.
I wonder how many of these are dirt cheap hosting servers, and no one who should care even knows the hosting company is asleep at the switch...
This is to be expected, the only organizations that were going to aggressively patch HB were going to be the googles, the microsofts, the ones with millions of assets and awareness of how much damage that it can cause. The ones that aren't going to patch are going to be your Bob and Joe's Bait Shop with the inexplicable online shop that's being managed by their nephew whenever he's in town from college, if he knows to.
This is why at different websites, you need different passwords. This way, it minimizes damage when it's not patched.
Just watch the video at http://www.komonews.com/news/consumer/Getting-passwords-under-control-261725121.html
In the video, they show as a more secure password for Amazon.com to be B@aseball9amazon
I don't think we should trust the video.
Why would someone patch the web server?
We don't like smart and taking initiative teenagers, here in the USA
1. Teenager sends email to administrators advising them about unpatched server.
2. SWAT raids the home of the kid.
3. DA sends the kid to private jail for life and announces running for another term.
4. ?
5. Profit or reality of life in the USA
You've packed a lot of wrong into such a short post. If a system is insecure a "good" architecture is irrelevant - you're still screwed. And either way, neither architecture nor cryptocurrencies have anything to do with this problem, which is unpatched OpenSSL.
John
most servers on the internet don't do anything important. this is sensationalist tripe.
If a system is insecure a "good" architecture is irrelevant - you're still screwed.
Dear John
Please can you explain how BitCoin is vulnerable to Heartbleed?
I think good architecture is essential to good security. That's why I posted.
Many Thanks
Jawad Yaqub
they should have been using mac servers! they come with X and remote desktop and art so you don't have to break a nail doing command line like a neanderthal!
Bitcoin itself is not vulnerable, as I understand it. But an online wallet using HTTPS with certain heartbeat-enabled TLS stacks may be vulnerable.
Maybe some of them are patched but nobody restarted apache/nginx/lighttpd/whatever so they still use old and vulnerable openssl version
So why are they using SSL in the first place?
who does not want to pay the X3 rate to get some out there now to fix it and will just wait for the next visit in there plan with there Outsourced IT plan.
Only 50% found it critical enough to deal with the problem quickly. The rest either have embedded systems or dependencies that are preventing them from upgrading or they aren't savvy enough to know that they're system is vulnerable. For example systems on Ubuntu 13.04 didn't get the heartbleed fix because 13.04 is at end of support, necessitating to first upgrade to 13.10 before getting the fix. You can of course roll your own and build it yourself etc. but most organizations aren't going to do that. There's also that small percentage that will never upgrade no matter what because they're is some other reason not to, org blow back or systems are near end of life for example.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Bitcoin used a vulnerable version of OpenSSL and required an update to Bitcoin Core to stop it from revealing the contents of it's memory to a remote attacker. That is why 0.9.1 came out in such short order after the disclosure of the Heartbleed vulnerability. See the Bitcoin Foundation's website: Heartbleed
Thirty four characters live here.
There are servers out there still broadcasting the "code red" worm...
Do not look at laser with remaining good eye.
Certificate Authorities (CA) could help here: if a secured server was mandatory to get certificate renewal, things would be cleaned up.
Problem is: each CA has no interest into doing this extra work, and no central authority can force them to do so. Major browsers could push them, though, by telling users that some CA are more trustable than others.
It seems you don't actually understand the topic you're speaking on here. Various bridged (inline) WAFs are capable of blocking Heartbleed attacks; Imperva offers one such solution. It is not necessary for the WAF to operate in a conventional proxy mode to accomplish this task, and there is no race condition involved. Why are you posting in an authoritative tone when you have no idea what you're talking about?
Write failed: Broken pipe
So why are they using SSL in the first place?
Looking for the "lock symbol" is the one thing the masses have managed to learn about Internet security.
People (the inexperienced ones) cause customer service headaches when they can't / won't learn that this system doesn't need it. "Where is the lock?" "How come you don't have a lock?" "My grandson says the lock means you are secure." etc.
For $40 a year, a company can head off 40 tech support calls with the worst type of users (the ones that don't even understand enough to put the answers in context and need 15 minutes of explaining to understand the answer) by slapping an SSL cert on every server. Sometimes it's even people in the "IT department" that have this gap in knowledge.
The company I work for does exactly this. I even got kudos for suggesting a wildcard cert would be cheaper and easier than individual certs for all the hostnames. Now it's standard procedure to slap the the cert on everything public facing. And, there's only one renewal date to deal with as opposed to a trickle of them every other week all year.
Also, I have SSH locked down to specific IP address, no Web service of any kind -- indeed, it's a "mostly closed" system with public-facing holes only for SSH (limited by tcpwrappers), SMTP (not SMTPS or SUBMISSION), DOMAIN (severely rate-limited and with blocks for ANY), NTP, and TRACEROUTE. This effectively blocks any access to heartbleed.
When the first alerts came out, the first thing I did was run the web-based exploit detectors. They didn't get through. At that time, I reviewed the services not blocked by the firewall, and to the best of my knowledge, none of the services I list above use the Secure Shell library. So I satisfied myself that my mail server was tight.
Everything else on my network is behind the same firewall, using NAT to gain access to the outside world. There is no open path to my desktop computers or internal-only servers.
I'm very much of the school "if it ain't broke, don't fix it in a hurry." In my case, I'm rebuilding servers (some celebrating 10 years of service or more) with the latest proven software one at a time, with the mail server being last in the chain. I'm replacing hardware as well as software, one by one. (I'm probably going to update the old hardware so I have standbys if the new hardware experiences infant mortality, but that's a detail.)
So, in come cases carefully researched, there isn't any need to take action against Heartbleed, because the exploits are blocked upstream.
On a similar note, my coffee machine is not vulnerable to HeartBleed. Another point for the engineers over at Saeco over the morons at OpenSSL, right?
An interesting anagram of "BANACH TARSKI" is "BANACH TARSKI BANACH TARSKI"