SSL Heartbleed

SSL heartbleed is a new vulnerability found on the the openssl library, which will allow unauthorized people to steal the data, which is normally protected by the SSL encryption.

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users.

Put it in a simple way, means that heartbleed bug will,

• Allow hackers to steal secret keys used in encryption.
• Names and passwords of the users.
• Read the encrypted communications between the service and user.
• Impersonate a malicious service as the real service.

Luckily a patch has been released and users should update their OpenSSL. You can read more information about the bug at heartbleed.com.

I tested some of the Sri Lankan sites that might be vulnerable to the heartbleed bug using an online tool available to test if you are affected using the bug. Here are some of the findings.

The bug is going around pretty fast on the internet and it would be better to patch the systems before it’s too late.

Sri Lanka domain registry nic.lk

Daily deal website mydeal.lk

I’m sure there are lots of other Sri Lankan websites that might be affected, you’re free to find them out, let me know if you do.