Heartbleed fixes taking longer as websites work to plug gaps
Business // Technology
By Jordan Robertson, Bloomberg April 14, 2014
Websites afflicted by the Heartbleed security flaw are finding that it's taking longer than expected to recover from the fallout.
Heartbleed, which can expose people to hacking of their passwords and other sensitive information, sent companies rushing to patch their systems after the security flaw came to light last week. What some didn't foresee was the time and cost needed to restore user data and fix interruptions caused by suppliers and partners.
Team Snap Inc., like many other Internet companies vulnerable to Heartbleed, sought to plug the vulnerability with a software update and minor technical adjustments, yet soon discovered that this wasn't enough. Team Snap's hosting company, which provides its Internet infrastructure, caused a breakdown when it applied its own fix and disrupted customer websites.
That scenario illustrates the hidden costs faced by individuals and businesses as they seek to fix one of the biggest security threats in Internet history, said Michael Shaulov, CEO and co-founder of Lacoon Security Ltd., a mobile-security company based in San Francisco.
"Just take the salary of all the people in IT and security and divide it by one week — that's probably for everyone, everyone across the board," Shaulov said. "There is a ripple effect."
Heartbleed, which was discovered by researchers from Google Inc. and a Finnish company called Codenomicon, affects OpenSSL, a type of open-source encryption.
BlackBerry Ltd. said in a blog post Thursday that some of its software, including its BBM messaging service for iOS and Android, is affected and that the company is working on fixes. BlackBerry smartphones and tablets aren't compromised, the company said. Calls to BlackBerry's corporate offices weren't immediately returned.
Networking equipment from Cisco Systems Inc. and Juniper Networks Inc. is at risk, and millions of smartphones and tablets running Google's Android operating system are affected.
Bloomberg reported Friday that the National Security Agency has known about the bug for two years and exploited it as a basic part of its spying toolkit. The Office of the Director of National Intelligence denied that the agency was aware of the vulnerability before 2014.
Yahoo Inc. found that some of its users' information spilled onto the Internet after its website was found to be vulnerable to the Heartbleed bug a day after its public disclosure.
"As soon as we became aware of the issue, we began working to fix it," the company said in an e-mailed statement.
San Antonio home sales jumped 7 percent in 2019
Investors flooding East Side homeowners with offers
In fast-changing San Antonio neighborhoods, homeowners flooded...
San Antonio's housing market: 'More affordability, more...
Lone Star Brewery property owner enters bankruptcy
Former hotel building to become mixed-income apartments
Local firm sells Northwest Side complex
Still Golden building to be demolished for new bank HQ
Firm proposes mixed-use project near Pearl
San Antonio home sales, prices still rising