@Website owners: Massive security leak. Will very likely affect your site!

[m_e]

Since many of you own a website, online service or shop I thought this might be very important for you. (Its also important for everyone else!)

There is a massive OpenSSL bug that has been discovered yesterday. Most of the websites and e-mail traffic is decrypted with OpenSSL. For example when you see the "https://" in front of your domain its a secure connection with OpenSSL.

What does it mean for you website owners?

If you have a shop. Everyone can read your customers information. Including credit card details! I am not kidding! You will not even notice it!

What to do?

1. First check if your website is affected with: http://filippo.io/Heartbleed . There are other ways but this is the easiest one I found. You can also check if you have OpenSSL version 1.0.1 – 1.0.1f installed. Those are the versions of the past 2 years!
2. If you are an admin, you have to upgrade the OpenSSL version to 1.0.1g. Then generate a new private key and also request and upgrade your SSL certificate.
3. If you are no admin... well contact one or whomever is going to manage your webserver.

What does it mean for everyone else?

Everything what you have done in the past 2 years on a secure connection might not have been secure. This means online banking, shopping, sending emails or anything else.

The bad thing if anyone has some encrypted server traffic from the past 2 years, (maybe he was in a online coffee and was listening to other users) he will now be able to decrypt that.

Since this bug has gone public now, I expect a lot of people to abuse it. Remember this before you login to the next website! Check the website first! (P.S. thefastlaneforum.com is not affected.)

What to do?

1. Hope that website owners upgrade to the latest OpenSSL version soon.
2. Change your login information on those services that have already upgraded or aren't affected.
3. Only use websites that aren't affected! (Check it with: http://filippo.io/Heartbleed)

This was probably a bit confusing now. I am really tired and gotta sleep. Just wanted to post that quick. For more information visit these sites or google "openssl heart bleed":
https://heartbleed.com/
http://www.cryptocoinsnews.com/news/openssl-heartbleed-security-bug/2014/04/08
http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[Dmitri]

Interesting, thanks for the info. I have actually got a call from the bank today telling me that someone got a hold of our business Visa number, including expiration date and security code and spend about $300 dollars worth on charities... some kind of Robin Hood. I wonder if this is how they got a hold of my credit card number when I was buying supplies on a website a few days ago.

 

[skekasaurus]

Thanks for spotting and reporting this, especially since this applies to my slowlane job. Informed our CIO, hopefully I'll get bonus for it!