Heartbleed zero-day uncovered with major potential security implications

DUBAI, UAE: Lucas Zaichkowsky, Enterprise Defense Architect at AccessData, responsible for providing expert guidance on the topic of CyberSecurity, has commented about today, a memorable day in the cybersecurity history books.

"Today certainly will be a memorable day in the cybersecurity history books. As the Internet swirls with the end of support for Windows XP today, another vulnerability has come to light that I would say is probably one of the most severe in terms of potential impact that I've seen in a while: the Heartbleed OpenSSL vulnerability.

"In short, SSL encryption makes network and Internet traffic unreadable to anyone who intercepts it, thereby protecting the sensitive data and personal information being transmitted. OpenSSL is commonly used by software to perform SSL encryption.

"The gist of the vulnerability is that attackers who exploit it are able to steal the encryption keys from internet servers and desktop software using OpenSSL for encrypting network traffic. They can then use those keys to decrypt the data. Making matters worse, even if vulnerable software is patched, previously captured encrypted communications can be still decrypted using the compromised keys.

"The security implications of this are very real - a significant amount of the software we implement today uses the OpenSSL library for encryption, affecting many popular server and desktop software packages and therefore putting business servers, corporate desktops and at-home users all at risk.

"This is an excellent example of vulnerabilities that exist within encryption products just waiting to be discovered. This particular programming error was introduced in December 2011 with OpenSSL version 1.0.1. Criminals could have been using it; intelligence agencies like the NSA could have been exploiting it; it's hard to say what those organizations have in their arsenal, being used quietly."