Menu
One month later, hundreds of thousands of servers still vulnerable to Heartbleed

One month later, hundreds of thousands of servers still vulnerable to Heartbleed

About a month after the OpenSSL Heartbleed bug surfaced, a large number of servers worldwide are still vulnerable to attack.

One month after the Heartbleed bug put Web security on notice, more than 300,000 servers worldwide are still vulnerable. That's the word from Errata Security's Robert Graham, who came to that number after scanning millions of Web servers on Internet port 443, which is used for TSL/SSL communication.

Graham's determination that 318,239 servers are still vulnerable to Heartbleed is a significant drop from the more than 600,000 he found when Heartbleed first became public.

Discovered in early April, Heartbleed is a devastating bug with the potential to reveal website encryption keys, usernames, passwords, and user data to attackers. The vulnerability was found in OpenSSL, a popular cryptographic tool designed to secure communications between a user's browser and a web server.

Read: The critical, widespread Heartbleed bug and you: How to keep your private info safe

But while Graham's numbers are concerning, they may not tell the entire story.

Graham said he could have scanned additional ports used for SSL communication, but focused only on the most common one, 443.

He also said he found 22 million systems with SSL support this time around, down from 28 million a month ago. That drop of 6 million systems, Graham theorises, may have been due to more systems detecting and blocking the scan for a Heartbleed vulnerability. Traffic congestion at Graham's ISP may have also been a factor.

If anything, it appears Graham's discovery of 300,000 vulnerable servers may be just the floor of potentially unpatched systems and not the roof.

Regardless, it's clear that many systems around the world still aren't patched to defend against the OpenSSL Heartbleed bug. And that may not change anytime soon.

A separate security research scan first reported by ArsTechnica found that in the past two weeks the number of unpatched servers dropped by just 0.44 percentage points. That slowing of patched servers suggests security updates for the Heartbleed bug have generally stopped, Vivaldi.net blogger yngve notes.

Read: Healing Heartbleed: Lastpass offers automated checker, major sites admit vulnerability

What's not clear, however, is exactly which sites and services are still vulnerable. Many large online companies have already taken great pains to let its users know they were not affected by the bug or that their servers are now protected against Heartbleed. So those vulnerable servers may be from  from smaller online services and businesses, but that is by no means certain.

Despite its hassles, Heartbleed can also be credited with inspiring some benefits for the general health of the web. In late April, numerous large Internet companies partnered with the Linux Foundation to create the Core Infrastructure Initiative (CII). The CII is an industry group charged with providing funding for widely used, critical open source projects such as OpenSSL that are in desperate need of financing and support.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Errata SecuritysecurityHeartbleedencryptionWebsites

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments