Slashdot Mirror
Over 300,000 Servers Remain Vulnerable To Heartbleed
An anonymous reader writes Even though it's been a couple months since the Heartbleed bug was discovered, many servers remain unpatched and vulnerable. "Two months ago, security experts and web users panicked when a Google engineer discovered a major bug — known as Heartbleed — that put over a million web servers at risk. The bug doesn't make the news much anymore, but that doesn't mean the problem's solved. Security researcher Robert David Graham has found that at least 309,197 servers are still vulnerable to the exploit. Immediately after the announcement, Graham found some 600,000 servers were exposed by Heartbleed. One month after the bug was announced, that number dropped down to 318,239. In the past month, however, only 9,042 of those servers have been patched to block Heartbleed. That's cause for concern, because it means that smaller sites aren't making the effort to implement a fix."
If those servers would have studied engineering instead of history, they probably would not be servers and not be suffering from broken hearts.
Time Bomber the Book coming soon.
I wonder how many of these are dirt cheap hosting servers, and no one who should care even knows the hosting company is asleep at the switch...
Why would someone patch the web server?
We don't like smart and taking initiative teenagers, here in the USA
1. Teenager sends email to administrators advising them about unpatched server.
2. SWAT raids the home of the kid.
3. DA sends the kid to private jail for life and announces running for another term.
4. ?
5. Profit or reality of life in the USA
You've packed a lot of wrong into such a short post. If a system is insecure a "good" architecture is irrelevant - you're still screwed. And either way, neither architecture nor cryptocurrencies have anything to do with this problem, which is unpatched OpenSSL.
John
Bitcoin itself is not vulnerable, as I understand it. But an online wallet using HTTPS with certain heartbeat-enabled TLS stacks may be vulnerable.
Only 50% found it critical enough to deal with the problem quickly. The rest either have embedded systems or dependencies that are preventing them from upgrading or they aren't savvy enough to know that they're system is vulnerable. For example systems on Ubuntu 13.04 didn't get the heartbleed fix because 13.04 is at end of support, necessitating to first upgrade to 13.10 before getting the fix. You can of course roll your own and build it yourself etc. but most organizations aren't going to do that. There's also that small percentage that will never upgrade no matter what because they're is some other reason not to, org blow back or systems are near end of life for example.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Bitcoin used a vulnerable version of OpenSSL and required an update to Bitcoin Core to stop it from revealing the contents of it's memory to a remote attacker. That is why 0.9.1 came out in such short order after the disclosure of the Heartbleed vulnerability. See the Bitcoin Foundation's website: Heartbleed
Thirty four characters live here.
LOL. Most certificate authorities are just saying 'here's what this guy told us his name is'. Basically worthless.
But it's nice to have a near monopoly service that's no better than a self signed certificate.
I apologize for the lack of a signature.