Heartbleed: Don't Panic
There’s been a lot of ink and pixels spilled of late over the Heartbleed bug. Yes, it’s serious. Yes, it potentially affects almost everyone. Yes, there are some precautions you should take. But there’s good news, too: for many people, it’s a non-event.
Heartbleed allows an attacker to recover a random memory area from a web or email server running certain versions of OpenSSL. The question is what’s in that memory. It may be nothing, or it may contain user passwords (this has reportedly been seen on Yahoo’s mail service), cryptographic keys, etc. From a theoretical perspective, this latter is the most serious; an attacker can impersonate the site, read old traffic that’s been recorded, etc. (Beside, cryptographers take key leakage very personally; that keys won’t leak is one of our core assumptions.) Is this a real risk, though? For many people, the answer is no.
In order to impersonate a site, an attacker has to redirect traffic you’re sending towards that site. If you only use the Internet via well-controlled networks, you’re probably safe. Yes, it’s possible to redirect traffic on the Internet backbone, but it’s rare and difficult. If a major intelligence agency is after you or that site, you’re at risk; most of us aren’t in that category. Cellular data networks are also in that category: it can be done, but it’s hard.
For most people, the weak link is their access network: their home, their workplace, the public or semi-public networks they use. It’s much easier to redirect traffic on a WiFi network or an Ethernet, and well within the capabilities of ordinary cybercriminals. If untrusted individuals or hacked machines use the same networks as you do, you’re at much more risk. Your residence is probably safe if there are no hacked machines on it and if you observe good security precautions on your WiFi network (WPA2 and a strong password). A small office might be safe; a large one is rather more dangerous. All public hotspots are quite exposed.
The other risk of Heartbleed is someone decrypting old traffic. That sounds serious, though again it’s hard to capture traffic if you’re not law enforcement or an intelligence agency. On exposed nets, hackers can certainly do it, but they’re not likely to record traffic they’ll never be able to decrypt. Law enforcement might do that, if they thought they could get assistance from the local spooks to break the crypto. They could also redirect traffic, with cooperation from the ISP. The question, though, is whether or not they would; most police forces don’t have that kind of technical expertise.
It’s important to realize that exposure isn’t all or nothing. If you regularly use a public hotspot to visit a social networking site but only do your banking at home, your banking password is probably safe. That’s also why your home network gear is probably safe: you don’t access it over the Internet. (One caveat there: you should configure it so that you can’t access it remotely, only from your home. Too much gear is shipped with that set incorrectly. If you have a router, make sure remote access to it is turned off.)
One more threat is worth mentioning: client software, such as browsers and mail programs, use SSL; some of these use OpenSSL and hence are vulnerable if you use them to connect to a hacked site. Fortunately, most major browsers and mailers are not affected, but to be safe, make sure you’ve installed all patches.
There’s one password you should change nevertheless: your email password. It’s generally used to reset all of your other accounts. "Probably safe" is not the same as "definitely". Accordingly, as soon as you know that your mail provider has patched its system (Google and Yahoo have, and Microsoft was never vulnerable), change it—and change it to something strong and use a password manager to save you from having to use the same new password everywhere.
Oh yes—if Martian Intelligence is after you (you know who you are), indeed you should be worried.
