Getting on the internet is easier than it has ever been before. Smartphones, tablets, laptops, watches and even some cars can get access to the internet. Usually when something is this easy to access, bad things can come from it. Starting with the very first virus back in the day, hackers and other criminals have been trying to find ways to gain access to information that is otherwise restricted to the public. Retail stores are getting hit with viruses that can read through customer information, including credit cards, social security numbers and addresses. Other viruses are just put online to close down websites as part of a political activist prank, but all in all, anything connected to the internet can be affected in some way. This year, the Hearthbleed bug brought the internet to a halt and even though website claim issues have been fixed, many believe otherwise. 

The Heartbleed bug is officially known as CVE-2014-0160 and is basically a security breach found inside of the OpenSSL cryptographic software. The cryptographic software is used by millions of websites these days, so you can imagine the panic that was caused by it. Typical uses for the OpenSSL software include web, email, instant messaging and virtual private networks used by many business and government agencies. The Heartbleed bug gives anyone on the internet access to read the memory of the systems that are protected by OpenSSL, but have the bug in their software. The bug compromises encrypted traffic, names, passwords and even the actual content of a website. Hackers can then easily spy on conversations or simply steal the data completely and use it in other ways than it was originally intended. This bug is unique when compared to others because it has left a large security rift that is not going to be fixed with just one software update like other, smaller bugs.

Companies and single users can recover from the bug, but in order to do that the effects of it had to be categorized as a primary key material, secondary key material, protected content and collateral. The main concern would be any information considered to be a primary key material. This would include being able to decrypt traffic from the past and the future, as well as use the services to impersonate them at will. The recovery process for this step can be very extensive depending on the situation. Even after all of the recovery steps are followed, any of the traffic intercepted by the hacker can still be used. All of the steps would have to be done by the owner of the services that were affected by the Heartbleed bug.

The secondary key material would be considered usernames and passwords that were taken in the attack. This step is a little easier to recover from and includes restoring the service and then allowing users to change the passwords and usernames on their account before moving forward with the service. All cookies and other session keys would be considered to be compromised at that point. Information that is considered to be leaked collateral includes the actual content of the memory. Technical details like security measures and even memory addresses. The good thing about information like this is that it will become useless to the hacker once the OpenSSL software is upgraded to fix the problem. Be aware that there is no recommended shortcut to fix any other problems that are listed here. WIth an attack of this size, there is no reason to believe that things are going to be better right away. Always trust emails and other messages that ask you to change your password, as long as they come from a source you recognize. Like many viruses, the masses might not ever realize it was an issue if they are not following up on the national news. The Heartbleed Bug affected OpenSSL installed on Apache and nginx servers which account for more than 66% of all the websites that operate on the internet worldwide.

In summary the Heartbleed bug is nothing to just forget about. The damage that can be done is very serious and the recovery information should be followed right away to avoid further issues with the OpenSSL software. At NetComplete, we do IT services better than anyone