WHETHER YOU GO ONLINE TO CHECK YOUR EMAIL, USE SOCIAL MEDIA, OR EVEN SHOP, YOU LIKELY
USE PASSWORDS IN MANY OF THE PLACES YOU VISIT ON THE INTERNET.
ENTER "HEARTBLEED" - A FLAW IN WIDELY-USED SECURITY SOFTWARE THAT ALLOWS HACKERS TO "BLEED"
OR STEAL PASSWORDS AND OTHER SENSITIVE INFORMATION FROM SERVERS.
THE POTENTIALLY DEVASTATING REVELATION ROCKED THE ONLINE WORLD, AND SET OFF A RACE TO PATCH
THE FLAW IN THOUSANDS OF WEBSITES.
I'M JOINED NOW BY VOA TECHNOLOGY BLOGGER AIDA AKL FOR MORE ABOUT HEARTBLEED AND WHAT IT
SIGNIFIES.
GLAD YOU'RE ON THE SHOW.
NOW WHAT EXACTLY IS HEARTBLEED AND HOW DOES IT ACTUALLY WORK?
HEARTBLEED IS A VULNERABILITY, IT'S CAUSED BY A CODING ERROR, IN OPENSSL SOFTWARE.
AND THAT IS A WIDELY USED SECURITY SOFTWARE, IT IS OPEN SOURCE, WHICH MEANS THAT THE CODE
IS PUBLICLY AVAILABLE.
AND ANYBODY WORLDWIDE CAN JUMP IN AND CONTRIBUTE TO THE PRODUCTION OF A CERTAIN APPLICATION.
AND THIS WAS DISCOVERED EARLIER IN APRIL, AND RESEARCHERS FOUND THAT IT HAD BEEN SITTING
THERE.
IT HAD BEEN THERE FOR ALMOST TWO YEARS WITHOUT ANYBODY KNOWING.
SO THAT' S KIND OF BIZARRE THAT SOMETHING LIKE THAT COULD BE, THAT SUCH A FLAW FOR SUCH
A LONG PERIOD OF TIME BEFORE ANYBODY NOTICES IT.
SO IT ALLOWS HACKERS TO STEAL PASSWORDS AND THE WEBSITE USER, THEY DON'T EVEN KNOW THAT
IT HAS BEEN STOLEN?
THAT THEY'VE BEEN INVADED, OR HOWEVER YOU WANT TO DESCRIBE IT.
IT CAN STEAL JUST ABOUT ANYTHING.
WHAT THEY DID WAS HACKERS THAT FOUND THIS FLAW WERE ABLE TO SEND INFORMATION PACKETS
TO THE SERVER THAT ARE DISGUISED, THEY HAVE DISGUISED SECURITY CREDENTIALS, SO THAT THE
SERVER IS TRICKED INTO RELEASING INFORMATION FROM ITS MEMORY TO THE HACKER.
NOW THAT MIGHT INCLUDE CREDENTIALS, PASSWORDS, NETWORK INFORMATION, STUFF THAT YOU DON'T
REALLY WANT TO GIVE OUT.
AND THE REASON WHY THIS TOOK EVERYBODY BY SURPRISE, IS THAT THIS IS PROBABLY ONE OF
THE FEW TIMES THAT SOMETHING LIKE THIS HAPPENS VERY EARLY IN NETWORK COMMUNICATION.
MEANING THAT THE SYSTEM DOESN'T FIND ANY TRACES, THERE ARE NO FOOTPRINTS, AND THE SYSTEM DOESN'T
HAVE TIME TO MOUNT A DEFENSE.
SO OK, I GUESS WHO WAS AFFECTED?
I MEAN, EVERYBODY.
HUNDREDS OF THOUSANDS OF WEBSITES WERE THREATENED, MOST OF THEM HAVE RUSHED TO PATCH THE FLAW
AND THERE MIGHT BE A FEW LEFT THAT ARE STILL PATCHING, BUT BY AND LARGE IT HAS BEEN FIXED.
BUT IT'S IMPORTANT TO MENTION HERE THE ISSUE WITH OPEN SOURCE.
BECAUSE THERE TYPICALLY IS A REVIEW PROCESS TO LOOK FOR ERRORS AND CODING AND THAT PROCESS
APPARENTLY DIDN'T WORK OUT VERY WELL IN THIS CASE.
SO IT ISN'T SOMETHING THAT IF A PRIVATE PERSON IS ONLINE AND THEY ARE SENDING THEIR PASSWORDS,
IT OCCURS ON THE SERVER ON THE OTHER END, RIGHT?
THERE IS NOT A WHOLE LOT THAT AN INDIVIDUAL PERSON COULD DO TO PROTECT THEMSELVES, IT
HAD TO FIXED ON THE OTHER END.
YES SOME WERE ABLE TO CHANGE THEIR PASSWORDS BUT OTHERS YOU KNOW IF THEY CHANGED THEIR
PASSWORD THEY RAN THE RISK OF HAVING THEIR KEYSTROKES LOGGED BY THE HACKER.
SO IT DEPENDED ON WHICH SITES WERE AFFECTED.
SO YOU'RE LOOKING AT THE YAHOOS, THE GOOGLES, THE FACEBOOKS, THOSE ARE THE FOLKS WHO HAD
TO FIX THEIR END.
I HEARD SOMETHING LIKE AMAZON, IT DIDN'T AFFECT THEM, SO SOME PEOPLE OR SOME COMPANIES WERE
NOT AFFECTED.
THAT'S RIGHT, NOT EVERYBODY WAS AFFECTED.
YES.
AND ACTUALLY ONE OF THE EARLIEST VICTIMS WAS CANADA'S TAX AUTHORITY.
THEY WERE HIT HARD.
THEY SAID THEY LOST INFORMATION FOR ABOUT 900 PEOPLE.
I'VE SEEN LARGER NUMBERS BUT THAT WAS THEIR NUMBER.
ANOTHER PLACE WAS A UK WEBSITE, A PARENTING SITE, APPARENTLY MORE THAN A MILLION MEMBERS
HAD THEIR INFORMATION COMPROMISED.
SO THESE WERE VERY EARLY IN THE GAME, BUT NOW THE FIXES ARE OUT THERE.
WOW, SOMETHING, IT GOES ON FOR TWO YEARS AND NOBODY CAN FIND IT.
AIDA AKL, SHE RUNS THE TECTRONICS BLOG, ACTUALLY, SO GLAD TO HAVE YOU ON THE SHOW.
THANKS FOR COMING ON.