Heartbleed bug: 300,000 websites still at risk -Experts

Security experts said that even though the bug was revealed a month ago, 300,000 sites are still affected.They claim that is half the sites at risk – and the security experts admit the poor response is ‘strange’.The Heartbleed bug lets hackers eavesdrop on supposedly secure communications.It was found by a team of researchers from Google […]

Security experts said that even though the bug was revealed a month ago, 300,000 sites are still affected.
They claim that is half the sites at risk – and the security experts admit the poor response is ‘strange’.
The Heartbleed bug lets hackers eavesdrop on supposedly secure communications.
It was found by a team of researchers from Google Security and Codenomicon in the OpenSSL cryptographic software.
OpenSSL is an open-source software that is widely used to encrypt web communications.
It is used to protect websites, instant messaging, email servers, virtual private networks and other communications.
OpenSSL certificates are also used to protect credit card details on select services.
The software is used in two of the most widely used Web servers, Apache and nginx.
Research by analytics firm Netcraft found almost 500,000 websites could be affected.
Security researcher Robert Graham of Errata security scanned over 1.5m servers that supported the vulnerable software in his report.
‘It’s been a month since the Heartbleed bug was announced, so I thought I’d rescan the Internet (port 443) to see how many systems remain vulnerable,’ he said.
“Whereas my previous scan a month ago found 600,000 vulnerable systems, today’s scan found roughly 300,000 thousand systems (318,239 to be precise).’’
However, he admits the tests hit problems.
“The numbers are a little strange.
“Last month, I found 28-million systems supporting SSL, but this month I found only 22-million. I suspect the reason is that this time, people detected my Heartbleed ‘attacks’ and automatically firewalled me before the scan completed.
‘‘Or, another problem is that I may have more traffic congestion at my ISP, which would reduce numbers.’
The massive flaw was first detected four weeks ago.
Affected sites include a number of Google services, including Gmail and YouTube, Facebook, Tumblr, Yahoo and Dropbox.
All of these sites have been patched and security experts are advising people to change their passwords on these accounts, even if the sites themselves aren’t issuing the advice.
Yahoo was the only major site that has explicitly said its users should change their password.
Graham Cluely from security software company Sophos told MailOnline that while it is difficult for websites to contact individual members directly – and they are not duty bound to do so – given the scale of the flaw, they could be doing more.  For example, Cluely suggests Google could post a link on its homepage for anyone who is concerned about the bug.
“This could link to helpful details and Google’s official statement about its services. It would also be helpful for the whole internet community because the site is so-widely used,’ he said.
In response to this, Google told MailOnline: ‘The security of our users’ information is a top priority. We fixed this bug early and Google users do not need to change their passwords.’
There is also confusion between what the companies are suggesting in terms of changing passwords, and what the security experts are advising.
People have been urged to change their details in response to the internet-wide bug, but it has emerged that changing login details may not boost security at all.
Some experts are advising users to change all their passwords across every site they have an account for, while others are being a little more selective.
But it has been revealed that the efficacy of changing your password depends on the sites you have accounts for – and in some instances changing your login details may be do more harm than good.