Support 110 years of independent journalism.

9 April 2014updated 09 Jun 2021 8:19am

The “Heartbleed” bug gives hackers access to all of your confidential info – how?

Web engineers are currently in panic mode as they try to repair the damage of a bug that has gone unnoticed for more than two years.

By Ian Steadman

There has been a major security bug discovered in one of the most popular mechanisms for keeping information confidential on the internet. The security company which discovered it, Codenomicon, is calling it “Heartbleed”, as it threatens such a vital, central part of how many websites work. It can give hackers access to all kinds of sensitive, confidential information – passwords, usernames, birth dates, anything – without leaving any trace of an attack.

To explain how it works, let’s first lay out how websites send private information to each other. When you’re reading the New Statesman website, for example, you’ve sent a request to the server the website’s on, and it, in turn, has fired back the digital bits that reconstruct themselves into the website on your screen. So far, so simple. But if you’re on a website where you’re logged in – everything from social media like Facebook to being logged into your Google account while searching for something online – there’s an added layer of privacy required to make sure that nothing can listen into the chatter between your computer and the server.

That layer can take the form of certificates, verified with cryptographic keys (just like the way that emails are encrypted, for example). You log in, the site verifies your login, and gives you a certificate that you then send along with your requests for each page you load so it knows that you are you. That’s why you only have to log in once per session. Each interaction between your computer and the server involves a swap of encrypted certificates, verifying that the data’s going to and from the same two end points every time. It’s a great way to stop hackers from sniffing in on a web traffic and hearing what’s being transmitted, as they won’t have the correct keys to decrypt it.

SSL and TSL protocols are the standard for encrypting and decrypting connections, with the open source OpenSSL being the most popular library of keys. What Codenomicon found was that – undiscovered since 2011 – there’s been a major flaw in OpenSSL’s library that effectively destroys its efficacy, and (as far as anyone can tell) nobody has noticed until now. Since OpenSSL is in use on roughly two-thirds of all sites, including major services like Yahoo, Tumblr, Twitter and Dropbox, a flaw this big affects millions upon millions of users.

What the Heartbleed bug does is let anyone ping a server and make it throw up information from its memory, in 64kb chunks. The data that leaks is completely random – it could be anything from among the server’s memory at that moment – and 64kb isn’t much, but there’s no encryption on it, and it can be done as many times as possible. Passwords, usernames, security keys used to encrypt databases, anything at all, drip by drip by drip, it can all bleed away.

Select and enter your email address Your weekly guide to the best writing on ideas, politics, books and culture every Saturday. The best way to sign up for The Saturday Read is via The New Statesman's quick and essential guide to the news and politics of the day. The best way to sign up for Morning Call is via
  • Administration / Office
  • Arts and Culture
  • Board Member
  • Business / Corporate Services
  • Client / Customer Services
  • Communications
  • Construction, Works, Engineering
  • Education, Curriculum and Teaching
  • Environment, Conservation and NRM
  • Facility / Grounds Management and Maintenance
  • Finance Management
  • Health - Medical and Nursing Management
  • HR, Training and Organisational Development
  • Information and Communications Technology
  • Information Services, Statistics, Records, Archives
  • Infrastructure Management - Transport, Utilities
  • Legal Officers and Practitioners
  • Librarians and Library Management
  • Management
  • Marketing
  • OH&S, Risk Management
  • Operations Management
  • Planning, Policy, Strategy
  • Printing, Design, Publishing, Web
  • Projects, Programs and Advisors
  • Property, Assets and Fleet Management
  • Public Relations and Media
  • Purchasing and Procurement
  • Quality Management
  • Science and Technical Research and Development
  • Security and Law Enforcement
  • Service Delivery
  • Sport and Recreation
  • Travel, Accommodation, Tourism
  • Wellbeing, Community / Social Services
Visit our privacy Policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications.

Even if OpenSSL is patched for a website, there are all kinds of knock-on consequences that might be an issue down the road – for example, it’s probably not worth changing your password out of fear that it’s been stolen if the website you’re registered on hasn’t done the patch yet. It could just be stolen again. Even worse, the security keys used to verify the certificates for each user, meaning the site’s entire database could be compromised. We just don’t know the scale of how bad things are yet. In the words of cryptography expert Bruce Schneier it’s a “catastrophic” bug. “On the scale of 1 to 10, this is an 11.”

There are limited things that users can do right now. This site lets you check if OpenSSL has been patched on a site you’re trying to visit, so before changing any passwords it’s worth testing that, but it’s going to be a few days before most site managers get a grips on the problem. As Steve Lohr writes in the New York Times: “Wait a day or so. Then change the passwords on the web services you use. That is probably the best advice…”

Content from our partners
What you need to know about private markets
Work isn't working: how to boost the nation's health and happiness
The dementia crisis: a call for action