The recently announced vulnerability in OpenSSL, known as “Heartbleed,” is a serious flaw that not only affects the majority of web servers in the world, but also touches countless other applications that use the affected software. Because Heartbleed gives an attacker direct access to memory stored on the web server, it is possible that certificates, keys, passwords, financial information, personal consumer information and other sensitive data have been exploited.
TLS is a widely used encryption protocol that is commonly utilized by webservers to protect sensitive information while in transit. Because Heartbleed allows an attacker to gain direct access to system memory – and because the logs would show nothing out of the ordinary – all of the data on the server may be compromised, making it difficult to know if an exploit has occurred in the first place. Because this vulnerability has been in existence for two years, organizations should assume that any system running vulnerable OpenSSL software might have been compromised. Read More
Tidak ada komentar:
Posting Komentar