One month later, hundreds of thousands of servers still vulnerable to Heartbleed

One month later, hundreds of thousands of servers still vulnerable to Heartbleed

About a month after the OpenSSL Heartbleed bug surfaced, a large number of servers worldwide are still vulnerable to attack.

One month after the Heartbleed bug put Web security on notice, more than 300,000 servers worldwide are still vulnerable. That's the word from Errata Security's Robert Graham, who came to that number after scanning millions of Web servers on Internet port 443, which is used for TSL/SSL communication.

Graham's determination that 318,239 servers are still vulnerable to Heartbleed is a significant drop from the more than 600,000 he found when Heartbleed first became public.

Discovered in early April, Heartbleed is a devastating bug with the potential to reveal website encryption keys, usernames, passwords, and user data to attackers. The vulnerability was found in OpenSSL, a popular cryptographic tool designed to secure communications between a user's browser and a web server.

Read: The critical, widespread Heartbleed bug and you: How to keep your private info safe

But while Graham's numbers are concerning, they may not tell the entire story.

Graham said he could have scanned additional ports used for SSL communication, but focused only on the most common one, 443.

He also said he found 22 million systems with SSL support this time around, down from 28 million a month ago. That drop of 6 million systems, Graham theorises, may have been due to more systems detecting and blocking the scan for a Heartbleed vulnerability. Traffic congestion at Graham's ISP may have also been a factor.

If anything, it appears Graham's discovery of 300,000 vulnerable servers may be just the floor of potentially unpatched systems and not the roof.

Regardless, it's clear that many systems around the world still aren't patched to defend against the OpenSSL Heartbleed bug. And that may not change anytime soon.

A separate security research scan first reported by ArsTechnica found that in the past two weeks the number of unpatched servers dropped by just 0.44 percentage points. That slowing of patched servers suggests security updates for the Heartbleed bug have generally stopped, blogger yngve notes.

Read: Healing Heartbleed: Lastpass offers automated checker, major sites admit vulnerability

What's not clear, however, is exactly which sites and services are still vulnerable. Many large online companies have already taken great pains to let its users know they were not affected by the bug or that their servers are now protected against Heartbleed. So those vulnerable servers may be from  from smaller online services and businesses, but that is by no means certain.

Despite its hassles, Heartbleed can also be credited with inspiring some benefits for the general health of the web. In late April, numerous large Internet companies partnered with the Linux Foundation to create the Core Infrastructure Initiative (CII). The CII is an industry group charged with providing funding for widely used, critical open source projects such as OpenSSL that are in desperate need of financing and support.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securityencryptionWebsitesErrata SecurityHeartbleed



Meet the leading customer-centric Microsoft channel partners

Meet the leading customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the leading customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments