Internet users told to change ALL passwords in security alert over 'catastrophic' Heartbleed bug
http://www.dailymail.co.uk/sciencetech/article-2601096/Internet-users-told-change-passwords-security-alert.htmlBy REBECCA EVANS and TANIA STEERE
Internet users have been warned to change all their computer and phone passwords following what could be a ‘catastrophic’ security breach.
Major technology firms have urged the public to immediately update their online security.
The alert is the result of the discovery of an internet bug called ‘Heartbleed’, which is able to bypass computer security settings.
LastPass Heartbleed Checker warns if a website may be at risk. It also reveals websites that aren't affected
HOW TO BEAT THE BUG
If a password is in any dictionary in any language then it will take just three minutes to crack, warned computer expert Tony McDowell.
The worst passwords are the likes of ‘password’, ‘123456’, ‘qwerty’, or your child’s name. Using the same password for every site can leave you even more vulnerable to hackers, he added.
His advice is to use a phrase rather than a word. For example, use ‘nameisabella’ rather than just ‘Isabella’ – and use a mixture of letters and numbers.
A password of ‘name!saBe1la’ would take a year to crack, said Mr McDowell, managing director of Encription Ltd.
‘Most hackers give up after 24 hours unless it is something they really want to gain access to,’ he added.
WHICH MAJOR SITES ARE AT RISK?
Potentially vulnerable sites:
Facebook, Twitter, Tumblr, Instagram, Google, Gmail, Lloyds TSB, Nationwide, Santander
Safe sites:
Bing, Yahoo, Flickr, LastPass, DuckDuck Go, Natwest, GitHub
The tool is a guide to affected services; it is not a definitive list.
Sites listed as vulnerable may use unreported servers, meaning their status can't be officially verified.
WHAT IS OPEN SSL?
OpenSSL is open-source software that is widely used to encrypt web communications.
It is used to protect websites, instant messaging, email servers and other communications.
It is also used to protect credit card details on select services.
Research by analytics firm Netcraft found almost 500,000 websites could be affected
HOW DANGEROUS IS IT?
The Heartbleed bug lets anyone on the web read the memory of the systems protected by vulnerable versions of the OpenSSL software.
It compromises secret keys used to identify the service providers and to encrypt web traffic.
This includes the names and passwords of the users and the actual content, such as credit card numbers.
Attackers can 'eavesdrop' on communications between servers, steal data directly from the them, and use the information to impersonate services and users on other sites or platforms.
James Lyne, global head of research at security firm Sophos told MailOnline: 'This fault undermines the fundamental trust on the internet for anyone running the vulnerable software and it is widely integrated into the technology we all use every day.
'While the fault has now been fixed, providers must apply it manually, so many still are vulnerable.
'Worse still, the defect was in the code for over two years before being discovered by security researchers - attackers could have discovered this at any time during that period and retrieved large volumes of data without anyone knowing.
'At this point the best thing for consumers to do is to assume their passwords and alike have been leaked. They may not have been, but since it's very hard to actually tell retrospectively, it is better to be safe than sorry.
'As providers rush to patch [the flaw], consumers should apply typical IT security best practice: ensure you change passwords - once you know the issue has been fixed by your provider; update your computers; and don't use the same password across multiple sites or services.
'This is not the first defect of its kind and it certainly won't be the last, but it is one of the more serious faults we've seen in recent Internet history.'
As a result, personal information such as passwords and credit card details has been accessible.
Heartbleed, so called because it creates a ‘bleeding’ leak of security, is a flaw in OpenSSL, the software used by the majority of websites to keep data secure.
The programme works by encrypting data – such as emails, instant messages, bank details or passwords – making it look like nonsense to hackers.
When a line of communication is secure and information encrypted, the user sees a padlock on the page. When software is active, one computer may send a ‘heartbeat’ – a small packet of data – to check there is still another computer at the other end.
However, a flaw in the programming meant it was possible to trick the computer at the other end by sending it a packet of data that looked like one of these heartbeats. This made it possible for hackers to impersonate the website and steal the encryption keys, revealing the data being sent.
The bug was found simultaneously by a Google security researcher and a small Finnish security firm named Codenomicon and disclosed on Monday night.
Many companies have installed a ‘patch’ to fix the flaw, but there are still many that are vulnerable as service providers must install the update.
Furthermore, it is not known whether hackers had used it before the bug came to light – it went undiscovered for two years – as doing so would not leave a trail.
A spokesman for Codenomicon said: ‘If people have logged into a service during the window of vulnerability then there is a chance that the password is already harvested.One of the worst affected sites was Yahoo!, who posted a warning on their blogging site Tumblr to say: ‘The little lock icon we all trusted to keep our passwords, personal emails, and credit cards safe, was actually making all that private information accessible.’
‘In that sense it’s a good idea to change the passwords on all the updated web portals.’
However, researcher Mark Schloesser said changing a password on websites that have not fixed the bug could reveal ‘both the old and new passwords’ to an attacker.
When contacted by the Mail last night, Britain’s major banks would not comment on whether passwords should be changed.
HSBC said they were ‘monitoring’ the situation and a Lloyds spokesman said they would not comment on security issues.
Will changing your password REALLY protect you from Heartbleed? Tech giants under pressure to advise and reassure users in wake of bug
http://www.dailymail.co.uk/sciencetech/article-2601379/Will-changing-password-really-protect-Heartbleed-Experts-warn-solution-not-simple-thought.htmlBy VICTORIA WOOLLASTON
Tech companies are facing increased pressure to do more to reassure their users about the Heartbleed bug.
Affected sites, including Google and Facebook, have fixed the problem, but its users are complaining they're still being left in the dark as to what it means for their personal data.
Meanwhile, there are still thousands of websites who are yet to fix the problem, or officially announce the fix - leaving their users in limbo.
Experts say the bug could leave up to 66% of sites vulnerable to hackers if their encryption software is not updated. It compromises secret keys used to identify the service providers and to encrypt web traffic. This includes the names and passwords of the users and actual content, such as credit card numbers
Affected sites include a number of Google services, including Gmail and YouTube, Facebook, Tumblr, Yahoo and Dropbox.
All of these sites have been patched and security experts are advising people to change their passwords on these accounts, even if the sites themselves aren't issuing the advice.
Yahoo is the only major site that has explicitly said its users should change their password.
HOW SITES ARE AFFECTED: THE THREE SCENARIOS
Websites fall into one of three groups - affected and at risk, affected and fixed and not affected.
Affected and at risk: This applies to sites that use the OpenSSL software but have not patched the flaw. Password and security experts have created tools to see which sites are at risk including the Heartbleed Test and Heartbleed Checker.
Affected and fixed: Affected sites include a number of Google services, including Gmail and YouTube, Facebook, Tumblr, Yahoo and Dropbox.
All of these sites have been patched and security experts are advising people to change their passwords on these accounts, even if the sites themselves aren't issuing the advice directly, as is the case with Google.
Users should ask sites directly for more information if they feel they're not being well informed.
Not affected: Sites that don't use the OpenSSL software are not affected by the flaw. This includes PayPal, Microsoft accounts and Twitter.
A number of these sites have been criticised for not contacting individual users to reassure them.
Graham Cluely from security software company Sophos told MailOnline that while it is difficult for websites to contact individual members directly - and they are not duty bound to do so - given the scale of the flaw, they could be doing more.
For example, Cluely suggests Google could post a link on its homepage for anyone who is concerned about the bug.
'This could link to helpful details and Google's official statement about its services. It would also be helpful for the whole internet community because the site is so-widely used,' he said.
In response to this, Google told MailOnline: 'The security of our users' information is a top priority. We fixed this bug early and Google users do not need to change their passwords.'
It did not comment on whether it would be issuing a statement directly to users, however.
MailOnline has similarly approached the other affected sites for comment.
There is also confusion between what the companies are suggesting in terms of changing passwords, and what the security experts are advising.
People have been urged to change their details in response to the internet-wide bug, but it has emerged that changing login details may not boost security at all.
Some experts are advising users to change all their passwords across every site they have an account for, while others are being a little more selective.
But it has been revealed that the efficacy of changing your password depends on the sites you have accounts for - and in some instances changing your login details may be do more harm than good.
Cluely continued: 'It is confusing and I understand why people are befuddled, but a [password] reset for everything is both unnecessary, and potentially exposing.
'Changing your password on a vulnerable site makes little difference because the site is still open to attack.
THE HEARTBLEED FLAW: HOW HAS IT AFFECTED MAJOR SITES
SITES THAT MAY REQUIRE A PASSWORD RESET
Google: Search, Gmail, YouTube, Wallet and the Play store were affected, but the Chrome browser and Chrome OS were not.
Google said it identified and solved the problem across its affected services, and is advising users they don't need to change their passwords. However, security experts are advising they should anyway, just in case.
Facebook: In a statement, the firm said: 'We added protections for Facebook’s implementation of OpenSSL before this issue was publicly disclosed. We haven’t detected any signs of suspicious account activity.'
It is encouraging users 'to take this opportunity to follow good practices and set up a unique password for your Facebook account that you don't use on other sites.'
Yahoo: Site has fixed the problem and is urging customers to change their passwords.
Tumblr: Owned by Yahoo, the blogging site was affected, but claimed it has spotted no evidence the breach affected its accounts.
Amazon Web Services (used by websites): Advisory note said 'most services were unaffected or Amazon was already able to apply mitigations' meaning passwords should be changed just in case.
Netflix: Statement said 'we took immediate action to assess the vulnerability and address it. We are not aware of any customer impact.'
Dropbox: The site tweeted it has patched all of its user-facing services and will continue to work to 'make sure your stuff is always safe'.
Canada's Tax Agency: Shut off public access to its website 'to safeguard the integrity of the information'; it holds. The agency said it hopes to re-open its website this weekend.
Instagram: Site runs on the nginx server, which uses OpenSSL software, and its SSL certificate was last valid three years ago meaning LastPass has flagged it as a potential risk and the company is working on a fix.
SITES NOT AFFECTED BY THE HEARTBLEED FLAW
Twitter: Site confirmed its websites weren't affected and details weren't exposed, so is safe.
Amazon.com: Site wasn't affected and details are safe.
PayPal: In a statement, the site said PayPal is secure. Your PayPal account details were not exposed in the past and remain secure. You do not need to take any additional action to safeguard your information and there is no need to change your password.
Ebay: As its payments are handled predominantly through PayPal, Ebay transactions were not affected.
U.S Internal Revenue Service: Was not affected by the flaw
Microsoft accounts, Hotmail and Outlook: Microsoft services don't use OpenSSL so were unaffected.
Bing.com: As it's a Microsoft service, it was unaffected.
Santander: Unaffected as it doesn't use the Open SSL software.
'This means your old password would have been at risk, but you're also giving hackers access to your new password - a double whammy.
'If a site hasn't fixed the security flaw, or hasn't told its users it has, then people should assume that site is vulnerable.
'It's good to assume that all sites are vulnerable and be cautious, until the sites state otherwise.
'My advice is only change the passwords on services that tell you they've fixed the problem.'
The flaw was introduced in OpenSSL in December 2011, and was 'in the wild' until Monday, when a new version fixing the flaw was released.
The worst case scenario is that someone found the flaw three years ago and has spent all that time scraping sites for personal details.
This does mean that if users have bought anything online from affected, supposedly secure, sites, signed up to accounts, or sent personal emails during that time, this data is potentially at risk.
Unfortunately, changing your address and credit card details aren't as simple as changing a password.
The problem with highlighting the flaw - despite the fact it has now been patched - is that people from around the world are running code to find affected sites.
Some of these people are curious security researchers and IT teams, but it could also suddenly be on the radar of would-be hackers and cybercriminals.
This makes the time between the flaw being found, and when the sites patch the problem as key - and the details may be more vulnerable now than they were before.
SHOULD I CHANGE MY PASSWORDS OR NOT?
Check the service providers’ official blogs for statements about whether or not they were affected and if the problem has been fixed.
The sites may have also emailed you so check your inbox, as well as junk mail.
Once a site has confirmed it is safe, update your login details. Even if a site claims you don’t need to, change it anyway – just in case.
Make sure to use different passwords across all accounts. This is good password management generally.
If you are unsure if a site has been affected, or is now safe, contact them. You can call or email and ask them to reassure you.
Many sites, including Google, Facebook and Twitter, pictured, as well as a number of banks, such as Natwest, have added optional two-step authentication, also known as two-step verification, to increase security for their customers
Take advantage of sites that use two-factor authentication. LifeHacker has a useful list of all the sites that offer this security measure.
As its name suggests, two-step authentication involves giving users two security steps to go through before being allowed access to their account.
This can include a text message sent to a phone, or a device that generates a unique number every 15 minutes.
In the case of the Heartbleed flaw, this means even if hacker steals a password from a site, they can’t access the account without the text or email code.
'We don’t know if someone has been exploiting the flaw beforehand so I don't think we should leap to any conclusions,' continued Cluely.
'However, in security its always best to assume the worst and restart from scratch where possible. It would be irresponsible to give blanket advice like changing all your passwords.'
This is because the fault is with the code used to build encryption software used by the sites as a whole, not just the user's account.
As a result, the onus is on the sites to fix the problem, but as the flaw is thought to affect so many websites, this may take some time.
WHAT IS THE HEARTBLEED BUG?
The Heartbleed bug lets hackers eavesdrop on supposedly secure communications.
It was found by uncovered by a team of researchers from Google Security and Codenomicon in the OpenSSL cryptographic software.
OpenSSL is open-source software that is widely used to encrypt web communications.
It is used to protect websites, instant messaging, email servers, virtual private networks and other communications.
OpenSSL certificates are also used to protect credit card details on select services.
The software is used in two of the most widely used Web servers, Apache and nginx.
Research by analytics firm Netcraft found almost 500,000 websites could be affected.
David Emm from security firm Kaspersky told MailOnline: 'Sites must apply the fix to the Open SSL library straight away, and also, importantly, if any encryption keys have been compromised, they need to be replaced too.'
When asked exactly what details are at risk, Emm continued it 'could be all kinds' from anything involved in a transaction - so that's usernames, password, encryption keys - to sensitive private credit card or address information, and virtual private network (VPN) data.
The latter is key for employers, for example. Employees who access systems outside of the office using a VPN could be exposing confidential and corporate information, as well as their own private details.
This has the potential to affect government, military and other high-profile and public sites as well as businesses - it doesn't just affect everyday users.
It all depends on whether the site uses Open SSL without any other encryption.
The Heartbleed bug lets hackers eavesdrop on supposedly secure communications.
It was uncovered by a team of researchers from Google Security and Codenomicon in the OpenSSL cryptographic software.
The software offers encryption services, such as when people log into internet banking, or into a webmail service like Yahoo.
The fault lets a hacker craft an attack which, under the right conditions, will return small chunks of information from the remote system or service.
OpenSSL is open-source software that is widely used to encrypt web communications. According to the tool, pictured, Bing.com doesn't use OpenSSL so is not at risk
For example, it has been demonstrated that hackers can steal other users’ usernames and passwords from Yahoo - although this flaw has now been fixed.
'The big sites fixed the problem very quickly because they have the resources to do so. In some cases the affected sites outsource IT teams, and there will be small and medium businesses to whom this may sound like gobbledegook. This is going to be a problem that remains for a while,' said Cluely.
When asked what users can do, Emm said: 'If people are concerned they can do a quick check using the Heartbleed Test.'
LastPass’ Heartbleed Checker similarly looks to see when a site’s secure encryption certificate was last valid and warns if the server may be at risk.
HOW DANGEROUS IS IT?
The Heartbleed bug lets anyone on the web read the memory of the systems protected by vulnerable versions of the OpenSSL software.
It compromises secret keys used to identify the service providers and to encrypt web traffic.
This includes the names and passwords of the users and the actual content, such as credit card numbers.
Attackers can 'eavesdrop' on communications between servers, steal data directly from the them, and use the information to impersonate services and users on other sites or platforms.
James Lyne, global head of research at security firm Sophos told MailOnline: 'This fault undermines the fundamental trust on the internet for anyone running the vulnerable software and it is widely integrated into the technology we all use every day.
'While the fault has now been fixed, providers must apply it manually, so many still are vulnerable.
'Worse still, the defect was in the code for over two years before being discovered by security researchers - attackers could have discovered this at any time during that period and retrieved large volumes of data without anyone knowing.
'At this point the best thing for consumers to do is to assume their passwords and alike have been leaked. They may not have been, but since it's very hard to actually tell retrospectively, it is better to be safe than sorry.
'As providers rush to patch [the flaw], consumers should apply typical IT security best practice: ensure you change passwords - once you know the issue has been fixed by your provider; update your computers; and don't use the same password across multiple sites or services.
'This is not the first defect of its kind and it certainly won't be the last, but it is one of the more serious faults we've seen in recent Internet history.'
'This flaw has highlighted why its never a good idea to use one password across all accounts - it only takes one account to be compromised to put all your accounts at risk,' continued Emm.
'It’s really important moving forward to be vigilant. Keep an eye on your bank statements and accounts and look for any unusual behaviour. Sanity check everything.'
Cluely added: 'If you do want to refresh a password and you're not sure if the site is vulnerable or not, opt for two-factor authentication.
Twitter and Facebook, for example, already offer this tool and then even if a password is stolen, they can't get into the account without the confirmation text message or email code.'
As its name suggests, two-step authentication involves giving users two security steps to go through before being allowed access to their account.
This can include a text message sent to a phone, or a device that generates a unique number every 15 minutes.
Both researchers stressed that its your information and if you don't feel like the provider is offering enough information, or being quick in their response to the problem, call and email them.
Security firm Lookout has created an app that tells users if they're running a vulnerable version of Android on their phone, pictured. While much of the conversation has been about how Heartbleed impacts servers and internet infrastructure, Lookout said it also affects mobile devices. The app is available from the Play store
Cluely said you should keep contacting them until they make a statement that reassures you.
Elsewhere, security firm Lookout has created an app that tells users if they're running a vulnerable version of Android on their phone.
While much of the conversation has been about how Heartbleed impacts servers and internet infrastructure, Lookout said it also affects mobile devices.
The app determines what version of OpenSSL the device is using and then checks to see if the specific vulnerable feature is enabled.
THE HEARTBLEED BUG: YOUR QUESTIONS ANSWERED
WHAT IS HEARTBLEED?
The heartbleed bug lets hackers eavesdrop on supposedly secure communications.
The heartbleed bug lets hackers eavesdrop on supposedly secure communications.
It was uncovered by a team of researchers from Google Security and Codenomicon in the OpenSSL cryptographic software.
The software offers encryption services, such as when people log into internet banking, or into a webmail service like Yahoo.
The fault lets a hacker craft an attack which, under the right conditions, will return small chunks of information from the remote system or service.
For example, it has been demonstrated that hackers can steal other users’ usernames and passwords from Yahoo - although this flaw has now been fixed.
HOW LIKELY IS IT THAT I’M AFFECTED BY THIS FLAW?
Experts are predicting around 17 per cent of all websites are affected.
The flaw originated in 2011 which means in theory, if you’ve used any of the affected sites in the last three years, you may be at risk.
OpenSSL is open-source software that is widely used to encrypt web communications.
It is used to protect websites, instant messaging, email servers, virtual private networks and other communications.
It is used to protect websites, instant messaging, email servers, virtual private networks and other communications.
OpenSSL certificates are also used to protect credit card details on select services and the software is used in two of the most widely used Web servers, Apache and nginx.
Research by analytics firm Netcraft found the figure of affected websites is almost 500,000.
The figures vary because many sites use OpenSSL in one way or another, leaving them vulnerable, but a select few use additional measures and encryption techniques to protect data.
DOES THAT MEAN MY DETAILS HAVE BEEN STOLEN?
Not necessarily. It may be that the Google researchers who discovered the flaw were the first to notice it. However, because a hack wouldn’t leave a trace, it’s hard to tell.
Security expert Graham Cluely told MailOnline: ‘We don’t know if someone was exploiting it beforehand so I think we shouldn’t leap to any conclusions. Assume the worst and restart from scratch where possible.’
David Emm from Kaspersky Lab urged people to be vigilant; to check their bank and online accounts for any suspicious activity and flag it up to providers as soon as possible.
I HAVE A WEBSITE, SHOULD I DO ANYTHING?
The flaw only affects sites that use OpenSSL in one way or another, so if your websites doesn’t use this software then you are not affected.
The flaw only affects sites that use OpenSSL in one way or another, so if your websites doesn’t use this software then you are not affected.
If you are unsure, speak to your web developer or IT team, where appropriate.
If you know that your site runs Open SSL, update it as soon as possible and replace your encryption keys.
Heartbleed bug: Am I at risk? Do I really have to change my password?
http://www.independent.co.uk/life-style/gadgets-and-tech/heartbleed-bug-should-i-change-my-passwords-9251143.html
The discovery of Heartbleed, a flaw in one of the most widespread encryption standards used online, has panicked webmasters and users alike.
The bug has gone unnoticed for more than two years and could have potentially given hackers access to an unlimited array of secure data – everything from passwords and login details to credit card numbers and addresses.
Although it’s difficult to say exactly how many websites have been exposed, the lower estimates are around 500 millionwith a large number of major web companies (Google, Facebook, Yahoo, etc) all forced to update their software to protect against the bug.
However, there have been quite a lot of mixed messages as to whether or not users should change their passwords, with some outlets urging that you should create new ones immediately while others are advising that you wait.
To add to the confusion there’s also been reports of hackers sending out phishing emails related to Heartbleed - in order to trick users into giving up passwords that have yet to be compromised.
Be on the look out for these and don't follow any links in suspicious looking emails - if you want to change a password go to the site directly.
Which sites are affected?
Most Google sites and services (including Gmail and YouTube - but not Chrome) were affected, as were sites maintained by Yahoo (including Tumblr and Flickr). Facebook was also hit by the bug although Twitter and LinkedIn were not.
Other big sites that have confirmed that they weren’t affected include Amazon, Hotmail and Outlook, eBay, PayPal and all of Apple’s properties – including iCloud and iTunes. If you want to check whether or not a site you use is still affected then you can do so here – just enter the URL.
Another big worry is for online banking, but thankfully we have some good news in that department. Lloyds, HSBC, RBS, Natwest, Santander and the Co-Op have all confirmed that they were not affected by the bug (they were using different encryption standards). Barclays has yet to issue a statement.
However, this does not mean that your credit card details are completely safe – as they could have been compromised via your Gmail or another third-party site. The security of mobile banking apps is still a developing situation as well.
So do I need to change my passwords?
In a word: yes. For the sites we’ve listed above as being affected (including Gmail, Yahoo, Tumblr, Flickr, Facebook) it definitely won't hurt to change your password some time in the next couple of weeks.
Although security experts have warned that you shouldn't be tooquick to change passwords, this is because not all website have patched their servers and changing your password before this happens could make matters worse. The sites we've listed above havepatched their servers and if you want to check one we've not mentioned - click here and enter the URL.
Unfortunately, some sites (including Google) have specifically said that users don't need to change their passwords. While it's true that some sites are confident that they fixed the bug a while back, as most of us are guilty of changing our passwords less frequently than we should do (aka never) we think that this is as good an opportunity as ever to be a bit more security-conscious.
What should my new password be?
In lists of the most frequently used passwords online there’s some obvious clangers that we know you’re too smart to use (these include old stand-bys such as ‘123456’ and ‘password’ itself) but just because a password doesn’t look obvious to you that doesn’t make it safe.
This means that you shouldn’t really use any single words that are found in the dictionary, any words connected to you (place of birth or pets' names), nor should you use any obvious ‘substitutions’ (eg pa55w0rd- more complicated variations are required) or patterns derived from your keyboard layout (eg ‘1qaz2wsx’ or ‘zxcvbnm’).
It’s wise to use a variety of characters in your password (including upper and lower case as well as numbers) but an easy way to get more secure is to start thinking of your password as a passphrase.
The easiest way of increasing the difficulty of a password is by simply making it longer – so try combining multiple words together and then adding in numbers between them.
You could pick a number of some significance to you (for example a loved one’s birthday, ie 12/08/1970) and then splicing this with a nonsensical phrase (‘shoesplittingwatchwizard’) to get a suitably difficulty password: Shoe12Splitting08Watch1970Wizard.
Other suggested methods for making a strong and memorablepassword include taking a sentence or a favourite line from a song as a starting point. So you might take the line "When you call my name it's like a little prayer" and turn it into wuCmNilaLP. Madonna is optional of course, but we think this a fun method - especially if you can work in numbers somewhere.
You should also use different passwords for your different accounts (perhaps the most difficult piece of advice to follow of all) and if you want to be really secure you should also set up two-step authentication where available.
No comments:
Post a Comment