Critical security bug gets South Africa sites and hosts scrambling for a fix

really quick patch don't know why the likes of afrihost and axxess havent updated by now
 
Hi all

Just want to follow up on this, I can confirm our team have implemented the relevant fixes from our end - we are no longer vulnerable on this :)
 
Also remember it takes quite some time to recycle SSL certificates. In our case it took more than 8 hours to recycle the EV certs due to the verification process and time difference.


Sent from my iPhone using MyBroadband Tapatalk
 
MagicDude4Eva said:
Also remember it takes quite some time to recycle SSL certificates. In our case it took more than 8 hours to recycle the EV certs due to the verification process and time difference.


Sent from my iPhone using MyBroadband Tapatalk
Click to expand...

Indeed it does! Our team rotated DNS addresses too, we've been working this since yesterday morning - the coffee has been flowing :)
This really is important to us, and our clients info and security is a top priority! Everything should be 100% with our servers.
 
garyc said:
Description of the bug at:

http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html
Click to expand...

I always thought that open-source projects go through a number of peer reviews and code-coverage checks. Certainly does not sound good and I am sure a number of additional checks will be established in future. It is certainly scary to see how many vendor notifications we received with infrastructure being affected (some of which I would not even have thought of).

@Afriguy - what was the purpose of rotating DNS addresses (switching out vulnerable IPs with patched ones?)?
 
MagicDude4Eva said:
I always thought that open-source projects go through a number of peer reviews and code-coverage checks. Certainly does not sound good and I am sure a number of additional checks will be established in future. It is certainly scary to see how many vendor notifications we received with infrastructure being affected (some of which I would not even have thought of).

@Afriguy - what was the purpose of rotating DNS addresses (switching out vulnerable IPs with patched ones?)?
Click to expand...

I understand that this is now a topical issue, but it's not always best to discuss security solutions in public forums. We're satisfied that we've addressed the issues - I see MyBB have also updated their article :)
 
I beg to differ, you have not addressed the issues.

You need to be telling all your clients to change their passwords, or in fact forcing a password change for all your users, as you can assume a good chunk of them are compromised. Its as simple as that.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X