Trust in the Internet took a major blow on Tuesday as alarm spread that software commonly used to encrypt and secure online transactions could wind up giving away the store.
Computer security specialists, Web site masters and fans of online privacy were worriedly abuzz with word of a freshly discovered flaw in online data-scrambling software that hackers can turn to their advantage.
A bug dubbed “Heartbleed” in OpenSSL encryption software lets attackers illicitly retrieve passwords and other bits of information from working memory on computer servers, according to cyberdefense specialists at Fox-IT.
“Expect everybody who runs an https web server to be scrambling today,” the Tor Project said in a warning posted at its Web site.
“If you need strong anonymity or privacy on the Internet, you might want to stay away from the Internet entirely for the next few days while things settle,” it said.
OpenSSL is used to protect passwords, credit card numbers and other data coursing through the Internet.
Information considered at risk includes source codes, passwords and “keys” that could be used to impersonate Web sites or unlock encrypted data.
“These are the crown jewels, the encryption keys themselves,” said a heartbleed.com Web site devoted to details of the vulnerability.
“Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will,” it said.
The flaw in OpenSSL essentially allows a hacker to read the memory of a machine working the software, but no more than 64 kilobytes of data at a time, security specialists said.
Nor can hackers control which bits of memory are tapped, leaving to chance what they get their hands on.
However, hackers could repeatedly grab packets of memory to ramp up the odds of stealing valuable data.
“There is no limit on the number of attacks that can be performed,” Fox-IT said in a blog post that listed steps business information-technology handlers can take to thwart incursions.
Security researchers reported being able to dig out Yahoo password information by taking advantage of the bug. Yahoo released a statement on Tuesday saying it had fixed the problem at its main online properties.
Fox-IT estimated that the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.
OpenSSL is used by more than half of Web sites, but not all versions have the vulnerability, according to heartbleed.com.
The group behind open-source OpenSSL put out a security alert urging users to upgrade to an improved version of the software and gave credit for finding the bug to Neel Mehta of Google Security.
Web sites will also need to change credentials used to verify authenticity to prevent hackers who may have looted the data from impersonating legitimate online venues and tricking visitors to enter valuable personal information.
As an added precaution, Internet users were advised to change passwords to online accounts or services they are intent on protecting.
Stephen Garrett, a 27-year-old graduate student, always thought he would study in China, but first the country’s restrictive COVID-19 policies made it nearly impossible and now he has other concerns. The cost is one deterrent, but Garrett is more worried about restrictions on academic freedom and the personal risk of being stranded in China. He is not alone. Only about 700 American students are studying at Chinese universities, down from a peak of nearly 25,000 a decade ago, while there are nearly 300,000 Chinese students at US schools. Some young Americans are discouraged from investing their time in China by what they see
MAJOR DROP: CEO Tim Cook, who is visiting Hanoi, pledged the firm was committed to Vietnam after its smartphone shipments declined 9.6% annually in the first quarter Apple Inc yesterday said it would increase spending on suppliers in Vietnam, a key production hub, as CEO Tim Cook arrived in the country for a two-day visit. The iPhone maker announced the news in a statement on its Web site, but gave no details of how much it would spend or where the money would go. Cook is expected to meet programmers, content creators and students during his visit, online newspaper VnExpress reported. The visit comes as US President Joe Biden’s administration seeks to ramp up Vietnam’s role in the global tech supply chain to reduce the US’ dependence on China. Images on
New apartments in Taiwan’s major cities are getting smaller, while old apartments are increasingly occupied by older people, many of whom live alone, government data showed. The phenomenon has to do with sharpening unaffordable property prices and an aging population, property brokers said. Apartments with one bedroom that are two years old or older have gained a noticeable presence in the nation’s six special municipalities as well as Hsinchu county and city in the past five years, Evertrust Rehouse Co (永慶房產集團) found, citing data from the government’s real-price transaction platform. In Taipei, apartments with one bedroom accounted for 19 percent of deals last
US CONSCULTANT: The US Department of Commerce’s Ursula Burns is a rarely seen US government consultant to be put forward to sit on the board, nominated as an independent director Taiwan Semiconductor Manufacturing Co (TSMC, 台積電), the world’s largest contract chipmaker, yesterday nominated 10 candidates for its new board of directors, including Ursula Burns from the US Department of Commerce. It is rare that TSMC has nominated a US government consultant to sit on its board. Burns was nominated as one of seven independent directors. She is vice chair of the department’s Advisory Council on Supply Chain Competitiveness. Burns is to stand for election at TSMC’s annual shareholders’ meeting on June 4 along with the rest of the candidates. TSMC chairman Mark Liu (劉德音) was not on the list after in December last