Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
Advertisement
Free Gartner Report:
Drive innovation & collaboration
with the "Everyone's IT" approach.

View the research report
World Wide Web
Is your endpoint data protected?
Average Rating:
Rate this article:  
Free McAfee Tool May Help Stop the Heartbleed

Free McAfee Tool May Help Stop the Heartbleed
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

Restoring confidence in the Internet after the Heartbleed bug will be a long road because its effects are so widespread there will be fall out for quite some time. That's why security firm McAfee has released a free tool to help users detect if they are susceptible. But McAfee says wait until a site is free and clear of Heartbleed before changing passwords.
 

As the Heartbleed bug fallout continues, McAfee is rolling out a free tool to help users detect how susceptible they are to its potentially dangerous impact. Heartbleed is a vulnerability in OpenSSL that has placed millions of Internet users’ personal information at risk.

Specifically, security researchers estimate that Heartbleed could affect up to two-thirds of all Web sites. It works by exploiting a vulnerability in the popular OpenSSL encryption software that protects usernames, passwords, credit and debit card numbers, and other personal information.

According to McAfee, this flaw in the SSL code could allow an attacker to gain access to system memory. Once that system memory is breached it could allow attackers to steal sensitive information or tap into personal communications. The security software firm said consumers should make a list of which sites they use that are affected and, after the sites are patched, change their account passwords.

Using Heartbleed Checker

“It’s important that users first check to make sure the Web sites they frequent are updated before changing their passwords,” said Gary Davis, vice president of consumer marketing at McAfee, part of Intel Security. “In the wake of confusing information floating around, our tool makes it easy for consumers to quickly access the information they need. Armed with this information, consumers can decide when it is time to change their passwords and regain confidence in a safe Web surfing experience.”

Here’s how it works: Consumers can enter the Web site domains into the Heartbleed Checker tool. The results will reveal if that Web site has been affected by Heartbleed. It does this by checking whether or not the sites have been upgraded to the version of OpenSSL that is not susceptible to the bug.

Of course, it may not be as easy as that in the end. Web collaboration company Meldium has rooted out a new bug that affects servers already patched for Heartbleed. It’s appropriately called “Reverse Heartbleed.” The firm said the mitigation steps are the same as for the regular Heartbleed attack: don't use vulnerable versions of OpenSSL. Meldium has launched a Reverse Heartbleed tester.

Difficult to Fully Remediate

We caught up with Tim Erlin, director of IT security and risk strategy at Tripwire, to get his take this ongoing story. He told us, in reality, the severity of the Heartbleed vulnerability isn’t about the vulnerability itself. It’s about the popularity of OpenSSL.

“It’s the popularity and pervasiveness of the OpenSSL library that makes this vulnerability difficult to remediate fully,” Erlin said. “While popular web applications may be already patched, the myriad of appliances, embedded devices and network infrastructure that may be vulnerable will take a lot longer to address. You can’t just disable the Internet for maintenance.”

Craig Young, security researcher at Tripwire, told us recovering from Heartbleed and restoring confidence in the Internet will be a long road, the effects of this bug are so widespread we’re going to see fall out for quite some time.” Young’s colleague, Tripwire security researcher Ken Westin, said it’s irresponsible to tell people to update all of their passwords everywhere, without providing context around the vulnerability.

“Changing your password on a site or service only mitigates Heartbleed risk if that service has patched their systems,” Young said. “If users change their passwords on a site or service that is still vulnerable, they may actually be putting themselves at greater risk as that new password is loaded into memory.”

All this is why McAfee is suggesting that consumers wait until after a site is free and clear of Heartbleed before changing passwords.
 

Tell Us What You Think
Comment:

Name:



UCS Invicta: Integrated Flash Why wait for the future? Unlock the potential of your applications and create new business opportunities today with UCS Invicta Series Solid State Systems. Take advantage of the power of flash technology. See how it can help accelerate IT, eliminate data center bottlenecks, and deliver the peak application performance and predictability your users demand. Click here to learn more.


 World Wide Web
1.   Twitter May Remove Pics of Deceased
2.   Google IPO Began Decade of Big Bets
3.   Assange Talks of Leaving Embassy
4.   Russian Hacker To Be Held Until Trial
5.   Online Sites vs. Retailing in India


advertisement
OkCupid Experiments with Daters
Unethical without user consent?
Average Rating:
Twitter May Remove Pics of Deceased
Balancing privacy and public interest.
Average Rating:
Online Retailers Ponder Actual Stores
'Click-and-mortar' shops popping up.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Researchers Find Malicious Android Apps Can Hack Gmail
A new study shows that a weakness in the Android mobile operating system can be used to steal sensitive, personal info from unwitting users. Gmail proved to be the easiest app to attack; Amazon, the hardest.
 
UPS Stores in 24 States Hit by Data Breach
Big Brown has been breached. UPS said that about 105,000 customer transactions at 51 of its UPS Store locations in 24 states could have been compromised between January and August.
 
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 

Enterprise Hardware Spotlight
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 
Feds OK $2.3 Billion IBM-Lenovo x86 Server Deal
IBM and Lenovo are celebrating U.S. approval of their x86-based server deal, having cleared some major security hurdles. The deal makes Lenovo a major player for enterprise data centers.
 
Three New Lenovo PCs Aimed at Business Users
With businesses wanting computing solutions that do more for less money, Lenovo has unveiled three new desktop PCs that it says offer solid computing at a budget-minded price.
 

Mobile Technology Spotlight
Screen Shortage Briefly Puts Brakes on iPhone 6
RAM? Check. Antenna switch? Check. Screen? Oops. Parts suppliers for Apple have found themselves facing a shortage of screens for the new iPhone 6 as next month's release date for the new smartphone looms.
 
Bounty Offered to Coders for Oculus Rift Bugs
Coders who find bugs in software for the Oculus Rift VR immersive headset could receive a reward of at least $500 under Facebook's White Hat bounty program. Facebook acquired Oculus in March.
 
Google Glass Adds Voice Access to Phone Contacts
The latest update to Google Glass will let users access their top 20 phone contacts with voice commands alone. A user can then choose a phone call, Google hangouts, e-mail or text messaging.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.