Menu
One month later, hundreds of thousands of servers still vulnerable to Heartbleed

One month later, hundreds of thousands of servers still vulnerable to Heartbleed

About a month after the OpenSSL Heartbleed bug surfaced, a large number of servers worldwide are still vulnerable to attack.

One month after the Heartbleed bug put Web security on notice, more than 300,000 servers worldwide are still vulnerable. That's the word from Errata Security's Robert Graham, who came to that number after scanning millions of Web servers on Internet port 443, which is used for TSL/SSL communication.

Graham's determination that 318,239 servers are still vulnerable to Heartbleed is a significant drop from the more than 600,000 he found when Heartbleed first became public.

Discovered in early April, Heartbleed is a devastating bug with the potential to reveal website encryption keys, usernames, passwords, and user data to attackers. The vulnerability was found in OpenSSL, a popular cryptographic tool designed to secure communications between a user's browser and a web server.

Read: The critical, widespread Heartbleed bug and you: How to keep your private info safe

But while Graham's numbers are concerning, they may not tell the entire story.

Graham said he could have scanned additional ports used for SSL communication, but focused only on the most common one, 443.

He also said he found 22 million systems with SSL support this time around, down from 28 million a month ago. That drop of 6 million systems, Graham theorises, may have been due to more systems detecting and blocking the scan for a Heartbleed vulnerability. Traffic congestion at Graham's ISP may have also been a factor.

If anything, it appears Graham's discovery of 300,000 vulnerable servers may be just the floor of potentially unpatched systems and not the roof.

Regardless, it's clear that many systems around the world still aren't patched to defend against the OpenSSL Heartbleed bug. And that may not change anytime soon.

A separate security research scan first reported by ArsTechnica found that in the past two weeks the number of unpatched servers dropped by just 0.44 percentage points. That slowing of patched servers suggests security updates for the Heartbleed bug have generally stopped, Vivaldi.net blogger yngve notes.

Read: Healing Heartbleed: Lastpass offers automated checker, major sites admit vulnerability

What's not clear, however, is exactly which sites and services are still vulnerable. Many large online companies have already taken great pains to let its users know they were not affected by the bug or that their servers are now protected against Heartbleed. So those vulnerable servers may be from  from smaller online services and businesses, but that is by no means certain.

Despite its hassles, Heartbleed can also be credited with inspiring some benefits for the general health of the web. In late April, numerous large Internet companies partnered with the Linux Foundation to create the Core Infrastructure Initiative (CII). The CII is an industry group charged with providing funding for widely used, critical open source projects such as OpenSSL that are in desperate need of financing and support.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Errata SecuritysecurityHeartbleedencryptionWebsites

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments