Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
What is Heartbleed Bug? (How it Works, Vulnerable Devices, How to Prevent
Heartbleed is a critical flaw in the widely used OpenSSL cryptographic software library. This flaw allows information to be stolen that is usually secured by the SSL/TLS cryptography used to secure the Web. SSL/TLS enables communication privacy and security for the internet, mail, messaging services, and some VPNs over the internet.
A defect in OpenSSL's implementation of the TLS Heartbeat extension causes the Heartbleed problem, which results in improper input validation.
It's an open-source software vulnerability that was initially discovered in 2014. Anyone with access to the Internet can use this flaw to access the memory of system vulnerabilities, leaving no trace of a breach.
OpenSSL is the most widely used open-source cryptographic library (written in C) for encrypting Internet data using Secure Socket Layer (SSL) and Transport Layer Security (TLS). Even though the problem is in the OpenSSL library, the SSL/TLS protocols are unaffected. The flaw is in the OpenSSL code that manages the TLS/DTLS Heartbeat extension.
Because of the vulnerability, an evil user might trick a susceptible web server into submitting sensitive information, such as usernames and passwords.
The private keys required to identify service providers and encrypt communications and the identities and passwords of users, and the actual information are all at risk. As a result, attackers can listen in on conversations, steal data straight from services and users, and impersonate those services and users.
Given that the Heartbleed Bug has been known for at least two years, any firm that has installed OpenSSL versions 1.0.1 through 1.0.1f is particularly vulnerable to it and should take action to mitigate it.
Discovery of the Heartbleed Bug
Google developer Neel Mehta and the Finnish security firm Codenomicon were the first to identify the Heartbleed flaw. German software developer Robin Seggelmann introduced the security weakness in the open-source OpenSSL encryption technology. Since the fault became widely known, Seggelmann has stated that he and another code reviewer accidentally overlooked the bug and that the bug was not intentionally introduced.
How the Heartbleed Bug Works?
To comprehend how the Heartbleed vulnerability works, you must first grasp how the TLS/SSL protocols function and how computers keep data in memory.
A heartbeat is an essential component of the TLS/SSL protocols. This is how the two computers interacting with each other let each other know that they're still connected, even if the individual isn't uploading or exporting anything right now.
On rare occasions, one of the systems will send the other an encrypted bit of data known as a heartbeat request. The second computer will respond with identical encrypted data, demonstrating that the connection has not been broken. The heartbeat request also gives data about its length, which is critical.
The Heartbleed flaw developed because OpenSSL's implementation of the heartbeat feature lacked a critical safeguard: the computer receiving the heartbeat request was never tested to see if it was as long as it was supposed to be.
The responding computer sends back its memory data due to a missing bounds check on the length and payload variables in Heartbeat queries and trusting the data received from other machines.
What are the Devices Vulnerable to the Heartbleed Bug?
Although all editions of Android OS contain older versions of the OpenSSL library, the vulnerable heartbeat component is enabled by default only in Android 4.1.1 Jelly Bean. Blackberry has also verified that specific devices are susceptible to the Heartbleed bug, but the OpenSSL flaw does not affect Apple's iOS devices.
IP phones, modems, medical equipment, Smart Television sets, embedded systems, and many other devices that rely on OpenSSL for encrypted communications may also be exposed to the Heartbleed problem, as patches from Google's Android partners are unlikely to arrive soon.
How to Avoid Such Software Vulnerabilities?
You can take the following measures to avoid software vulnerabilities like the Heartbleed bug −
Integrate security-related tasks that are essential for secure software development.
Never place your trust in data from a third-party source.
To ensure the security of your online accounts, you should change your passwords as soon as possible for both the sites that have fixed the problem and those that have not.
405 Views
