Heartbleed Bug & Open SSL Vulnerabilities

It's everywhere. On the news, radio, TV, Internet - The HeartBleed.  The HeartBleed bug is a computer internet virus that takes advantage of a defect in OpenSSL security encryption software.

The  OpenSSL security encryption software is the software that displays a padlock in your web browser ensuring that the website you are visiting or  cloud services you are using is safe. OpenSSL security encryption is also used in operating systems, firewalls, routers, switches and software programs.

OpenSSL security encryption software  is the most popular security software used  to encrypt internet traffic and activity. It is used by Google, Facebook, Amazon, lots of big IT conglomerates.   The information OpenSSL is designed to protect, is not protected. Information such as usernames, passwords, credit card information, client files, company data, is no longer private if you have a vulnerable version of OpenSSL.

You and your information are not protected from hackers because there is a hole in the security enabling sneaky people to get in and steal information, undetected.

The Heartbleed bug allows anyone on the internet access to  vulnerable versions of OpenSSL software enabling attackers to eavesdrop, steal and impersonate you and your services.The flaw in the security encryption is a coding error in the programming and  has existed under the radar for 2 years.

How it works is when computers communicate over a secure connection, computers check to see if the other computer is 'still there' when exchanging information. This is done  by sending a small packet of data called a "heartbeat"  that is confirmed between the communicating computers.  The hole in the encryption software allows hackers to use a false packet of data tricking the computer (think trojan horse) into responding and giving access  to information that is securely stored freely. 

Even if you do not frequently use the internet, statiscally the odds are in favour of you being affected because OpenSSL is the most popular open source cryptographic library and transport layer security implementation used to encrypt traffic on the internet. Somewhere within the logistics of using the internet, or cloud services OpenSSL security encryption software would have been used. You should check with your service providor or computer person to ensure that your version of OpenSSL used by your operating systems, firewalls, routers, switches and software is not vulnerable.

Kinda a big oops, EH?  CRA extended the tax deadline to May 5th.  They had to ensure the patch/update was in play for everyone EFiling their returns.  They need to be sure their online services were safe.

Here is a link to the HeartBleed Hit list and the passwords you need to change right now;

https://mashable.com/2014/04/09/heartbleed-bug-websites-affected/

 

   

(function(){
var s='hubspotutk',r,c=((r=new RegExp('(^|; )'+s+'=([^;]*)').exec(document.cookie))?r[2]:''),w=window;w[s]=w[s]||c,
hsjs=document.createElement("script"),el=document.getElementById("hs-cta-7f289feb-e427-43f4-b4ff-24bb291ab7fd");
hsjs.type = "text/javascript";hsjs.async = true;
hsjs.src = "//cta-service-cms2.hubspot.com/cs/loader.js?pg=7f289feb-e427-43f4-b4ff-24bb291ab7fd&pid=245212&hsutk=" + encodeURIComponent(c);
(document.getElementsByTagName("head")[0]||document.getElementsByTagName("body")[0]).appendChild(hsjs);
try{el.style.visibility="hidden";}catch(err){}
setTimeout(function() {try{el.style.visibility="visible";}catch(err){}}, 2500);
})();

               

(function(){
var s='hubspotutk',r,c=((r=new RegExp('(^|; )'+s+'=([^;]*)').exec(document.cookie))?r[2]:''),w=window;w[s]=w[s]||c,
hsjs=document.createElement("script"),el=document.getElementById("hs-cta-25b335a2-861c-4a28-936d-3d7c88500cd9");
hsjs.type = "text/javascript";hsjs.async = true;
hsjs.src = "//cta-service-cms2.hubspot.com/cs/loader.js?pg=25b335a2-861c-4a28-936d-3d7c88500cd9&pid=245212&hsutk=" + encodeURIComponent(c);
(document.getElementsByTagName("head")[0]||document.getElementsByTagName("body")[0]).appendChild(hsjs);
try{el.style.visibility="hidden";}catch(err){}
setTimeout(function() {try{el.style.visibility="visible";}catch(err){}}, 2500);
})();