A month after the Heartbleed OpenSSL security vulnerability was first publicly disclosed, there are strong indications that there are still a whole lot of vulnerable users.
Technically, the Heartbleed flaw is identified as CVE-2014-0160 and called “TLS heartbeat read overrun.” It is found within the open-source OpenSSL cryptographic library, which provides Secure Sockets Layer (SSL) encryption capabilities for data in transit. The OpenSSL project first released its own patch for the Heartbleed flaw on April 7, but that hasn’t meant that everyone in the world has actually updated.
OpenSSL is widely deployed in servers and embedded devices including Android phones. To actually protect users from Heartbleed, there are multiple steps that need to be taken. For both servers and end-user devices, an updated OpenSSL package needs to be installed. On the server side, SSL certificates need to be regenerated and end users need to reset their passwords.
Security researcher Robert Graham noted in a blog post on May 8 that he scanned the Internet to find systems still vulnerable to Heartbleed and found 318,239 systems still at risk.
That’s not the whole story on the Heartbleed risk though. In addition to patching OpenSSL, server administrators also need to regenerate SSL certificates. But as it turns out, though many SSL certificates have been reissued, they weren’t all reissued correctly.
A study from Netcraft published on May 9 indicates that across all sites it scanned that were affected by Heartbleed, 43 percent reissued their SSL certificates. That means there are still a whole lot of sites with potentially vulnerable users.
Adding further insult to injury, Netcraft found that 7 percent of the reissued SSL certificates were done with the same private key. The way that SSL works is that there is a private encryption key on the server that is used to enable security.
“By reusing the same private key, a site that was affected by the Heartbleed bug still faces exactly the same risks as those that have not yet replaced their SSL certificates,” Netcraft stated. “If the previous certificate had been compromised, then the stolen private key can still be used to impersonate the website’s new SSL certificate, even if the old certificate has been revoked.”
So even though many Websites have patched for Heartbleed, not all have reissued SSL certificates, and even then there is still a risk. Perhaps the larger issue, however, is the fact that Heartbleed continues to be a security concern more than 30 days after first being disclosed and is likely to remain a risk for months, if not years, to come.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.