heartbleed bug/virus

[matts6887]

Has anyone else heard of this? I just heard about it yesterday from my local abc station affiliate. Take a look at the link below and tell me what ya think:

[FONT=&quot]Heartbleed bug: Online security flaw exposes millions of passwords_ - ABC15 Arizona

I tell ya; it sounds pretty scary to me. I hope someone comes up with a fix for it and quick!
[/FONT]

 

[Phone Man]

Its a server problem running OpenSSL 1.0.1 and there is a fix available. Other versions of that software are not affected. Affected companies are in the process of fixing their systems.

Jim

 

[BJB]

Three useful links -

BBC News - Heartbleed bug: What you need to know

Limiting the impact of Vulnerability in OpenSSL Heartbeat | We use words to save the world | Kaspersky Lab Official Blog

Test your server for Heartbleed (CVE-2014-0160)

 

[Britton30]

I tried www.sevenforums.com in the checker and got this result.

Uh-oh, something went wrong: dial tcp: lookup www.sevenforums.com : invalid domain name
Check what it means at the FAQ.
It might mean that the server is safe, we just can't be 100% sure!

Same results with my bank and Newegg too.

 

[crawfish]

For users, there's nothing you can do about affected sites but change passwords, and there's no point in changing passwords before getting confirmation that the site had the issue and has fixed it. If a site hasn't fixed it, logging into it now is a lot riskier than before the bug was disclosed. Here's one site serving as a clearinghouse for this information for some popular sites:

The Heartbleed Hit List: The Passwords You Need to Change Right Now

Most sites are staying pretty silent on the issue, and I definitely wouldn't expect to find a statement on their front pages, though it would be a reasonable expectation given the apocalypse-themed coverage by the media.

I went ahead and changed my Yahoo and Google passwords, though Google said it isn't necessary. (But how would they know?)

 

[Britton30]

Thanks for that link crawfish!

I called my bank and they have been aware of Heartbleed since yesterday and are patched.

 

[matts6887]

I wonder if that means i should go ahead and change any passwords for any bank accounts i have online access to?

 

[Britton30]

I wonder if that means i should go ahead and change any passwords for any bank accounts i have online access to?

Give them a call first. but it's a good idea to change sensitive passwords regularly anyway.

 

[A Guy]

Has anyone else heard of this? I just heard about it yesterday from my local abc station affiliate. Take a look at the link below and tell me what ya think:

[FONT=&quot]Heartbleed bug: Online security flaw exposes millions of passwords_ - ABC15 Arizona

I tell ya; it sounds pretty scary to me. I hope someone comes up with a fix for it and quick!
[/FONT]

Take a look in the Security News section

A Guy

 

[3Colors]

It is recommended to change the password for Facebook, Gmail ? Because apparently they are already patched.
Heartbleed bug: Check which sites have been patched - CNET

Accounts of EA / Origin were affected ?

 

[Golden]

Yes you should. In addition, you should clear your browser history, auto form filling and password storage in the browser. If you use Chrome or Firefox or forks thereof, you should opt to check for SSL certicate revocation too.

 

[3Colors]

Thanks for the tip, did not know that

The last box too? Active X

I have Chrome installed but do not use it, I use the explorer. Something else to do in the internet explorer ?

 

[NoelDP]

Just for interest, here's the email I got from Namecheap the other day....

Hello Noel,

A critical OpenSSL vulnerability nicknamed “Heartbleed” was discovered recently. IMPORTANT: It is very likely that you are impacted by this vulnerability. Read on for more info.

Details you should know:
1. This is not a vulnerability with SSL Certificates or Namecheap.
2. SSL/TLS is not broken, nor are the digital certificates issued by Comodo or Symantec brands.
3. Users of OpenSSL versions 1.0.1 through 1.0.1f with the heartbeat extension enabled are affected. OpenSSL version 1.0.1g addresses the vulnerability, as well as OpenSSL instances compiled without the heartbeat extension.
4. As a precaution to protect your data, we highly recommend that all Namecheap users change their account passwords.

We have created a detailed Knowledgebase article where you can learn about Heartbleed, determine whether you are affected, and find out what to do next. Please read the article as soon as you can. It’s located here: https://www.namecheap.com/support/knowledgebase/article.aspx/9343

Take care of yourselves, your domains, certificates and servers!
Thank you and don't hesitate to contact us if you have any questions.

 

[3Colors]

I do not know much about it but it seems like something out of a movie.

I think there will be a percentage of users who have not changed their passwords.