Heartbleed Continues to Beat Even After Nearly Three Years

In April 2014 a big vulnerability and the fixes created for it were released to the public. It is referred to as Heartbleed and at the time, affected approximately 600,000 servers. Nearly three years later, nearly 200,000 remain vulnerable to this OpenSSL issue. The only good news to this issue is that financial institutions do not use OpenSSL so this issue will not affect online banking, your money is safe.

OpenSSL is used to secure data that is sent between a client, such as the browser on your laptop to a server, such as a website you visit using your browser. In a nutshell, Heartbleed is so dangerous because data sent between the two locations, like your chat messages, some printer commands, etc. gets encrypted during transmission. While there are other methods of encrypting the data, this one is a freebie that accommodates many types of tasks. This issue being discussed here prevents the safe delivery of data using this free tool. 

Unfortunately, OpenSSL is used on roughly 66% of the Web. Most of us have no idea what is going on behind the scenes when visiting our favorite websites and there is a very good possibility that we are encountering this at least once a day; likely a lot more. And if one of your regularly visited websites has not been fixed, you probably don’t know about it and even if you do, there is nothing you can do about it.

However, those who are responsible for any of these nearly 600,000 servers that remain unpatched can do something about this. It’s really important that you get it fixed. A lot of people are relying on it. This hole has been around since 2011, so those who designed it have been wreaking havoc for a very long time already and are continuing to do so on those vulnerable machines. Put this task at the top of your to-do list.

According to a report from a search using Shodan, an Internet search engine for querying, as of January 22, 2017, around 199,594 servers were still unpatched. The largest number of them resides in the United States (42,032), followed by Korea (15,380), China (14,116), and Germany (14,072). Also on the list are locations in France, Russia, the UK, India, Brazil, and Italy.

According to Errata Security, the timeline for vulnerable devices follows:

• April 2014 – 600,000
• May 2014 – 320,000
• January 2015 – 250,000
• May 2016 – 200,000
• January 2017 (end) – 180,000

So, while they are slowly being addressed, Heartbleed is still beating on. It’s not alone, however. Microsoft stopped supporting Windows XP in 2014, yet it is estimated by NetMarketShare that 9% of desktops are still running it.