Information Security Alert: Heartbleed bug

‌

A major worldwide vulnerability has been discovered that may affect two-thirds of the websites on the Internet.

There is a flaw in versions of OpenSSL that allows access to information that would normally be protected through secure connections. The “Heartbleed bug” allows anyone on the Internet access to see what’s in the memory of systems protected by Open SSL, leaving no evidence that they’ve done so. Approximately two-thirds of all websites are affected. Researchers reported the bug on April 7, but the vulnerability has existed since 2011. Note that this is not a breach of a password database. Website owners and vendors worldwide are in the process of updating/patching the servers hosting these websites.

RIT has successfully secured the vast majority of our computing infrastructure with patches and other mitigations. Some lower profile services have been taken offline until patches are released and mitigations applied. This is a necessary step to protect RIT.

RIT continues to work with vendors to implement patches and other mitigations.

The RIT Information Security Office continues to conduct vulnerability scanning of the RIT network until all vulnerabilities have been addressed.

For RIT passwords, please change your passwords. Given the scale of this vulnerability, there is concern that passwords may be at risk. For personal passwords, we recommend that you change your passwords. Priority should be given to sites accessing private information, financial accounts and email. Note that if the website is still vulnerable, you may need to change your password again after the site is patched.

Stop using the same password for multiple sites. Create a new unique password for each site.

Be alert for phishing attempts leveraging the publicity around the OpenSSL bug.

For more information:

The Heartbleed Bug

Heartbleed: What You Should Know (The Washington Post)

Half a million widely trusted websites are vulnerable to Heartbleed bug (Netcraft)

How to Protect Yourself From the Heartbleed Bug (Mashable)

LastPass Heartbleed checker (Note: This allows you to put in a website address to determine if it’s been fixed.)