This Netcraft tool flags sites affected by Heartbleed
The new browser plug-in can identify Web sites that maybe vulnerable to the OpenSSL bug
IDG News Service - Worried about how the Heartbleed vulnerability may affect your personal accounts? A new tool may be of help.
British Internet security services provider Netcraft has released a browser extension that alerts users when a site they visit hasn't been patched to protect against malicious use of the Heartbleed vulnerability, found in certain versions of the OpenSSL (Secure Socket Layer) encryption library.
The free extension can be installed on the Chrome, Firefox and Opera browsers.
OpenSSL is an open-source implementation of the SSL and TLS (Transport Layer Security) protocols, which are used to encrypt sensitive data, such as passwords, so they can transmitted securely across a public network.
Only certain versions of OpenSSL are affected by Heartbleed. These affected versions were mostly deployed in conjunction with the open source Apache and Nginx servers -- which run about 66 percent of all servers on the Internet.
A fix is available but there is no way for consumers to tell if the sites they visit have applied the patch.
Even when a site has fixed the vulnerability, attackers might have already used Heartbleed to purloin the private key of the site, which means they could steal data by way of a man-in-the-middle attack.
Netcraft's extension, an update of a previously released security tool, checks to see if the site could be vulnerable to the Heartbleed bug, using data from a prior Internet-wide automated survey the company conducted.
If so, the software then checks the private key certificate of the site a user is visiting to see if it has been updated since the Heartbleed disclosure. If not, the site is flagged as unsafe.
- Why Open Source Software Isn't as Secure as You Think
- Heartbleed still matters, and we're all partly to blame
- The Next Heartbleed: 5 Security Vulnerabilities to Watch
- Security Manager's Journal: Dealing with the heartburn of Heartbleed
- Rush to fight Heartbleed leads to errors with certificates and patches
- Security Manager's Journal: With Heartbleed, suddenly the world is paying attention to security
- Kenneth van Wyk: Looking beyond Heartbleed
- Tip of the Hat: Heartbleed prompts chastened tech giants to fund OpenSSL
- Most but not all sites have fixed Heartbleed flaw
- 3 privacy violations you shouldn't worry about
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- The Shortfall of Network Load Balancing Applications running across networks encounter a wide range of performance, security, and availability challenges as IT department strive to deliver fast, secure access...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Malware and Vulnerabilities White Papers | Webcasts