More than 300k systems 'still vulnerable' to Heartbleed attacks

Two months after the infamous Heartbleed bug was revealed, more than 300,000 systems connected to the internet remain vulnerable to attacks exploiting the vulnerability.

When security researchers carried out a scan of web servers and other connected devices after the revelations on Heartbleed, a vulnerability in much-used encryption standard OpenSSL, 600,000 systems were affected.

On Saturday, Errata Security’s Robert Graham said a month after Heartbleed broke, more than 300,000 were still open to attack and that figure had barely moved following a scan on 20 June. Now, 309,197 are still vulnerable, he added.

“This indicates people have stopped even trying to patch. We should see a slow decrease over the next decade as older systems are slowly replaced,” Graham added in a blog post. “Even a decade from now, though, I still expect to find thousands of systems, including critical ones, still vulnerable.”

Heartbleed can be fixed by updating OpenSSL, which can be done by following the correct links on the open-source project’s official website or by updating operating systems that carry the code. Anyone still running vulnerable systems should update their encryption keys too, as they may have already been stolen.

While servers running many of the world’s websites were left vulnerable by Heartbleed, leading to compromises of data on a handful of sites including Mumsnet, other devices could also be attacked if left open. These include CCTV cameras, webcams, baby monitors and mobile applications.

Attackers can steal encryption keys and other data from vulnerable machines by sending requests that trick them into coughing up more data from their memory than they should.

It’s likely people are failing to patch out of “simple ignorance as to the importance of the task, the fact they are vulnerable or the process to be followed”, said James Lyne, global head of security research at Sophos

“We see this every day with other web attacks … which are trivial to fix but still show up to the order of 30,000 new hacked sites a day.

There was also confusion around what Heartbleed was, with some believing it was a virus, when in reality it was a weakness in the design of the OpenSSL software that could have been exploited. That many Heartbleed detectors didn’t work properly only exacerbated the problem.

There now appears to be “a sense of auto update”, Lyne added. “Many have gotten rather used to auto updating built in to our everyday technology. Manual intervention like this is an unusual experience for most admins, so perhaps it has fallen on confused ears.”

Adrian Hayter, from security consultancy Hut3, said there were many Linux operating system versions that contained the flawed code. “Any system that is based on these old distributions would be vulnerable if they have not been updated.”

Hayter added that the vast numbers of machines that remain vulnerable may be sitting in large hosting companies.

“I would imagine that there are a lot of hosting companies which provide shared hosting environments in Linux that have not been updated, purely because these systems are not created with security in mind - they are very cheap, meant for low budget websites, and the hosting company doesn't care much about the data on them.”