One month later, hundreds of thousands of servers still vulnerable to Heartbleed

About a month after the OpenSSL Heartbleed bug surfaced, a large number of servers worldwide are still vulnerable to attack.

One month after the Heartbleed bug put Web security on notice, more than 300,000 servers worldwide are still vulnerable. That's the word from Errata Security's Robert Graham, who came to that number after scanning millions of Web servers on Internet port 443, which is used for TSL/SSL communication.

Graham's determination that 318,239 servers are still vulnerable to Heartbleed is a significant drop from the more than 600,000 he found when Heartbleed first became public.

Discovered in early April, Heartbleed is a devastating bug with the potential to reveal website encryption keys, usernames, passwords, and user data to attackers. The vulnerability was found in OpenSSL, a popular cryptographic tool designed to secure communications between a user's browser and a web server.

Read: The critical, widespread Heartbleed bug and you: How to keep your private info safe

But while Graham's numbers are concerning, they may not tell the entire story.

Graham said he could have scanned additional ports used for SSL communication, but focused only on the most common one, 443.

He also said he found 22 million systems with SSL support this time around, down from 28 million a month ago. That drop of 6 million systems, Graham theorises, may have been due to more systems detecting and blocking the scan for a Heartbleed vulnerability. Traffic congestion at Graham's ISP may have also been a factor.

If anything, it appears Graham's discovery of 300,000 vulnerable servers may be just the floor of potentially unpatched systems and not the roof.

Regardless, it's clear that many systems around the world still aren't patched to defend against the OpenSSL Heartbleed bug. And that may not change anytime soon.

A separate security research scan first reported by ArsTechnica found that in the past two weeks the number of unpatched servers dropped by just 0.44 percentage points. That slowing of patched servers suggests security updates for the Heartbleed bug have generally stopped, blogger yngve notes.

Read: Healing Heartbleed: Lastpass offers automated checker, major sites admit vulnerability

What's not clear, however, is exactly which sites and services are still vulnerable. Many large online companies have already taken great pains to let its users know they were not affected by the bug or that their servers are now protected against Heartbleed. So those vulnerable servers may be from  from smaller online services and businesses, but that is by no means certain.

Despite its hassles, Heartbleed can also be credited with inspiring some benefits for the general health of the web. In late April, numerous large Internet companies partnered with the Linux Foundation to create the Core Infrastructure Initiative (CII). The CII is an industry group charged with providing funding for widely used, critical open source projects such as OpenSSL that are in desperate need of financing and support.

Tags Errata SecuritysecurityHeartbleedencryptionWebsites


Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Business Risk Management Solutions

Create and deliver online assessments to identify business risks and track their mitigation and resolution.

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.