Heartbleed bug causes havoc online as retailers and banks affected

The discovery of a bug in coding on an estimated 66% of websites has revealed that online data may have been exposed for up to three years.

The discovery of a bug in coding on an estimated 66% of websites has revealed that online data may have been exposed for up to three years.

A test run on 8 April revealed that bank websites including Privatbank’s Russian and Ukranian sites, Barclaycard’s US site and UniCredit’s German subsidiary HypoVereinsbank were vulnerable to the "Heartbleed" bug.

Ari Takanen, chief technology officer at Codenomicon, the Finnish security firm that discovered Heartbleed, said: "If people have logged into a service during the window of vulnerability then there is a chance that the password is already harvested.

"In that sense it’s a good idea to change the passwords on all the updated web portals."

Joe Abbey, director of software engineering at Arxan Technologies, said: "Unlike the Target incident, which required malware on end-point devices (POS terminals), this exploit allows scanning of server memory from any end-user machine on the internet without the requirement to get any malware on to the computer.

"Also, in the Target incident the software exploited was an obscure POS application, whereas this exploit is in code that is open source and has been reviewed by literally thousands of expert eyes for years (showing that a severe exploit can exist right in plain sight)."

Amazon was also revealed to be one of the websites using the flawed coding, potentially exposing card details, although the retailer said it had applied ‘mitigations’ to protect users.

The Canadian Revenue Agency (CRA) has suspended its web services, include online tax returns, as a preventative measure.

Considered one of the most serious security flaws uncovered in recent years, it is still unclear if any hackers have taken advantage of Heartbleed.

Non-banking and payment sites affected included Google, Facebook and Yahoo.

All have reported being in the process of fixing the Heartbleed bug threat or having already dealt with it.

 

Related articles:

Dutch banks warn customers to stop using Windows XP due to fraud risk

Nearly twenty-fold increase in mobile banking Trojans – Kaspersky Labs

Bank of Ireland customers hit by ATM skimming attack