A bug in the OpenSSL software library that has been dubbed \u201cHeartbleed\u201d by the researchers that discovered and reported it had websites and hosting companies, including many in South Africa, scrambling to deploy patches yesterday (Tuesday, 8 April 2014).<\/p>\n
However, the security concerns caused by the bug do not end once the library is patched.<\/p>\n
Heartbleed lets anyone, without any knowledge of a server or privileged access, obtain 64 kilobyte chunks of a server\u2019s heap memory remotely without leaving any indication that they have \u201chacked\u201d the server.<\/p>\n
According to the researchers, this memory may contain usernames and passwords, and even the private keys used to sign a site\u2019s certificate.<\/p>\n
While the bug doesn\u2019t affect all web servers, the majority (at least 66%, according Netcraft data) of sites on the web use software impacted by this bug.<\/p>\n
Asked about the seriousness of the bug, Chief technology officer for information security firm SensePost<\/a>, Dominic White<\/a> said that it is \u201cpretty serious\u201d.<\/p>\n White provided a link to a developer\u2019s program on Github which scans Alexa\u2019s list of top sites<\/a> for the Heartbleed bug.<\/p>\n At around 21:00 last night 1,258 (or 12%) of the top 10,629 sites tested as vulnerable.<\/p>\n \u201cThat\u2019s 12% of some very big name sites that are vulnerable,\u201d White said. \u201cBut, that also means 88% of this list of big name sites aren\u2019t vulnerable.\u201d<\/p>\n By the time of publication (around 16:00, 9 April 2014), the tool reported that the number had dropped to 627 sites that appeared vulnerable.<\/p>\n Yahoo.com<\/a> was among the vulnerable sites, and the web has been full of reports of security researchers who were able to get the usernames and passwords of Yahoo! Mail users due to the Heartbleed bug.<\/p>\n While being able to get sensitive data such as usernames and passwords is a massive security concern, White said they haven\u2019t seen a proof of concept that actually exposes the private keys used to sign SSL certificates yet.<\/p>\n \u201cThis doesn\u2019t mean it\u2019s not possible, or isn\u2019t coming, just that nobody has demonstrated it, despite numerous tools now existing,\u201d White said.<\/p>\n If it is possible to get an SSL private key from the server memory in this way, White said that \u201ca bad guy could put up a fake site with the real SSL certificate, or potentially decrypt encrypted communications they were intercepting.\u201d<\/p>\n In short, this means that even if servers are patched there are larger ramifications that would probably require website owners to revoke their security certificates and obtain new ones, as well as advise users to change their usernames and passwords.<\/p>\n Among the local sites confirmed to be affected by the bug were Bidorbuy<\/a> and Capitec Bank<\/a>\u2019s corporate marketing website.<\/p>\n Bidorbuy<\/strong> CTO Gerd Naschenweng<\/a> said yesterday that they had patched their servers and were waiting on advice from their certificate provider on how to proceed.<\/p>\n \u201cWe received feedback from Verisign that we should also recycle private keys and [certificates], so we are in the process of doing this as well,\u201d Naschenweng told MyBroadband.<\/p>\n Kalahari.com<\/strong>\u2019s Kirby Gordon<\/a> said that they are aware of the issue and are not affected.<\/p>\n WebAfrica<\/strong> CTO Alan Kirton<\/a> said that a proportion of their Linux-based hosting environment was susceptible to Heartbleed.<\/p>\n \u201cWe implemented all appropriate patches as soon as we became aware of the bug and we are busy advising our customers on the best ways to protect themselves,\u201d Kirton said.<\/p>\n Mweb<\/a> said that the majority of their environment are Windows-based and only a very small number (less than 5%) of their sites on Linux use OpenSSL.<\/p>\n While the fix is relatively straight-forward and was being rolled out to their current managed server estate yesterday, Mweb said that there is no way of knowing whether a server has been exploited in the last two years since OpenSSL 1.0.1 was released.<\/p>\n \u201cWe are addressing this by revoking and reissuing certificates after the version has been updated,\u201d Mweb said.<\/p>\n Update<\/strong>: At 21:46 on Wednesday, Afrihost let us know that the Afrihost and Axxess sites have been patched. Tests with online Heartbleed vulnerability checkers confirm that the sites at the root domains for the ISPs are no longer vulnerable. It is worth noting that at the original time of writing the Afrihost Clientzone and Axxess Customer Control Panel sites were not testing as vulnerable.<\/p>\n A Capitec<\/strong> spokesperson told MyBroadband that their IT Risk department said that their corporate marketing website was patched yesterday morning and that their Internet banking is not vulnerable to Heartbleed.<\/p>\n CEO for FNB<\/strong> Online Banking, Lee-Anne van Zyl<\/a>, said that they are not vulnerable to the bug as none of their public-facing sites use OpenSSL for encryption.<\/p>\n Nedbank<\/strong> provided a similar answer, saying that an all their critical transactional systems have been reviewed and found not to be vulnerable.<\/p>\n \u201cWe are continuing our investigations on non-critical systems,\u201d Nedbank said. \u201cWhere vulnerabilities are highlighted, we will engage suppliers to provide the required mitigation in line with our standard processes.\u201d<\/p>\n Absa<\/strong> and Standard Bank<\/strong>\u2019s Internet banking system also do not appear to be vulnerable, but neither bank answered questions put to them on the matter.<\/p>\n Update:<\/strong> An Absa spokesperson has provided the following statement:<\/p>\n We have robust processes in place to manage any potential risk that may arise on our network and this third party vulnerability would be treated and handled as such.<\/p><\/blockquote>\n White said that there are a few good tools out for checking if your server is vulnerable, but warned that many aren\u2019t complete.<\/p>\n For this reason you should patch your servers even if these tools say they aren\u2019t vulnerable, White said.<\/p>\n Massive security bug may leave SA sites vulnerable<\/strong><\/a><\/p>\n Google user info requests for SA criminal investigations<\/strong><\/a><\/p>\n Wi-Fi hacking quadcopter from SA security firm<\/strong><\/a><\/p>\nSouth African sites, hosts affected<\/h3>\n
\n\n
\n Domain<\/td>\n Heartbleed vulnerability<\/td>\n<\/tr>\n \n Online banking<\/td>\n Currently vulnerable<\/td>\n Previously vulnerable<\/td>\n<\/tr>\n \n netbank.nedsecure.co.za<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n ib.absa.co.za<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n online.fnb.co.za<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n direct.capitecbank.co.za<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n encrypt.standardbank.co.za<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n Banks<\/td>\n Currently vulnerable<\/td>\n Previously vulnerable<\/td>\n<\/tr>\n \n absa.co.za<\/td>\n No SSL<\/td>\n No SSL<\/td>\n<\/tr>\n \n capitecbank.co.za<\/td>\n No<\/td>\n Yes<\/td>\n<\/tr>\n \n standardbank.co.za<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n fnb.co.za<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n nedbank.co.za<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n E-commerce sites<\/td>\n Currently vulnerable<\/td>\n Previously vulnerable<\/td>\n<\/tr>\n \n Kalahari<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n Takealot (secure.takealot.com)<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n OLX<\/td>\n No SSL<\/td>\n No SSL<\/td>\n<\/tr>\n \n Gumtree (gumtree.co.za)<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n Bidorbuy (bidorbuy.co.za)<\/td>\n No<\/td>\n Yes<\/td>\n<\/tr>\n \n Wantitall<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n Have2have<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n Internet and hosting service providers<\/td>\n Currently vulnerable<\/td>\n Previously vulnerable<\/td>\n<\/tr>\n \n afrihost.com<\/td>\n No<\/td>\n Yes<\/td>\n<\/tr>\n \n clientzone.afrihost.com<\/td>\n No<\/td>\n Yes<\/td>\n<\/tr>\n \n axxess.co.za<\/td>\n No<\/td>\n Yes<\/td>\n<\/tr>\n \n ccp.axxess.co.za<\/td>\n No<\/td>\n Yes<\/td>\n<\/tr>\n \n mweb.co.za<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n myaccount.mweb.co.za<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n telkom.co.za<\/td>\n No SSL<\/td>\n No SSL<\/td>\n<\/tr>\n \n login.telkom.co.za<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n secureapp.telkom.co.za<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n webafrica.co.za<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n dsl.webafrica.co.za<\/td>\n No<\/td>\n Unknown<\/td>\n<\/tr>\n \n Other services<\/td>\n Currently vulnerable<\/td>\n Previously vulnerable<\/td>\n<\/tr>\n \n DStv<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n Supersport<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n South African banks respond<\/h3>\n
Update! Even if you don\u2019t think you\u2019re vulnerable<\/h3>\n
More information security news<\/h3>\n