https://www.bbc.co.uk/news/technology-26935905

This is a real big deal apparently.
Not up with the tech jargon myself but I wouldn't log into yahoo mail for the next day or two.
https://twitter.com/search?q=yahoo%20heartbleed&src=typd
Gmail and Hotmail are safe

Also if you use Lastpass to store passwords they are also vulnerable.

If you want to know if any particular server is vulnerable you can test it here:

https://filippo.io/Heartbleed/

Put in yahoo.com and it comes up vulnerable.

This vulnerability has been out there for 2 years apparently.

More here: https://www.reddit.com/r/programming/comments/22ghj1/the_heartbleed_bug/

Just tested Indiegogo and its vulnerable.

https://filippo.io/Heartbleed/#indiegogo.com

Hey Andy does this effect me in any way?

It effects everyone, it is incredibly serious.

It means that any "secure" server still vulnerable to this bug is in no way secure.

Using the exploit it is possible to dump (copy) a large portion of the servers memory, and depending on whats in the servers memory at the time determines how bad it is. Its bad for the server admins as it means a complete compromise for them but In practical terms for us, it is possible for attackers to steal your login info, your credit card info, read your emails, read PM's, everything you do on a vulnerable website and any information you have on there can be viewable/stealable. Its very serious indeed.

Check any site for vulnerability before logging in to it.

While it is a serious bug, there are tons of vulnerabilities online and always have been. Essentially, if you have information stored online, or on a computer that that you use online, someone can get their paws on it if they want it bad enough. Drive by java exploits, trojans hidden in software/video downloads, phishing, xss injection attacks etc etc etc. Plus of course you have the ever popular employee fraud and negligence where your personal information is left on an unencrypted disc on the train Its a vulnerability for sure, but how many people do you know that had have their bank accounts emptied due to this vulnerability which has existed since 2012?

diforumreject wrote:
I think you're blurring the lines here somewhat.

I like to make distinctions between social engineering based attacks, client/local exploitation and server exploitation. Server based attacks are by far the worst. You can't actually answer your question either. There may have been a great deal of incidents of fraud attributed to this exploit but the method of obtaining such info was never found.

There may have only been 100 serious incidents due to it, but 100 is enough and now that its in the wild and skids have gotten their hands on it, there will be much much more.

SilvaRizla wrote: not really, I would say I'm just putting it into perspective
SilvaRizla wrote: server based attacks have been around for years, how many sites get defaced, taken over using various techniques including xss injection on dbase driven websites? Answer = lots! Getting to the root on a server is one of the most popular attacks online, spammers use this for phishing, link building, hosting spam gateway pages and email blasts all the time. I know plenty of people that have experienced this, including me! This latest vulnerabilty is just another exploit, that is now mostly fixed.
SilvaRizla wrote: Ok I'll rephrase the question, this vulnerability has been around for 2 years now, how many people do you know that have had their bank accounts emptied but don't know the exact method used? My answer=none. Yes it happens, has always happened, probably will always happen. Just putting things into perspective.

check out this similar doom announcement 2 years ago
www.bbc.co.uk/news/technology-16812064

nothing new here

In addition I would suggest the time to really panic about an exploit or vulnerability, is when a select few are using it to extract money from bank accounts while the online banking companies are scratching their heads wondering how they are doing it!

Once the exploit is splashed across the mainstream media worldwide and every IT bod in the universe knows about it and how to fix it, much less worrying, but a still good headline.

diforumreject wrote:
I'd can't say I agree, for example the link you've posted would need to make use of either a drive-by or some form of social engineering or local exploit first. Its fairly straight forward to FUD the malware packaged with some illegal download. In other words, it would only affect those committing dodgy downloads, or those stupid enough to click on some dodgy a link in an email from some Thai bride or whatever.

This new vulnerability is server based only, its the biggest thing since SQLi and in a completely different league to your standard skids spreading RATs, or Ugandan Phishers. Some of the the most secure servers in the world are having their pants pulled down and its nothing that can be blamed on the end user.

diforumreject wrote:
You mean say if you were sitting on a massive list of bank details that you might get from I don't know, the heartbleed bug, and all you had to do was wait until you'd figured out how to transfer/wash the money? Yeah thats pretty bad.

People won't empty entire bank accounts, they might take £1 from a million accounts though, wash them through some bitcoin servers and get them paid to their own account.

Yes its nothing to worry about at all....

SilvaRizla wrote:
there is a big difference between my statement of "much less worrying", when categorising an exploit which has become well known, and your sarky "Yes its nothing to worry about at all" comment, as I am sure you know.

I stand by my statement, now this bug is known and being patched, it is definitely much less worrying.

diforumreject wrote:
Well it is less worrying yes, but its been unpatched for 2 years, would you notice if a quid went missing from your account? I bet people have made millions off this already

SilvaRizla wrote:
well it remains to be seen whether or nor people have been siphoning money from accounts using this exploit over the last 2 years, however, as yet I am struggling to find a single case of theft or fraud reported. What is more certain however, is now that the exploit is known, the threat is largely over, with banks patching the exploit and changing passwords etc if system was affected.

That scenario you posted about hackers stealing £1 from a million accounts to get £1million, I know that happened in a movie, but has it ever happened in real life? I cant find examples of that either, though it does sound familiar, but perhaps I am thinking of that movie:-) All the big frauds I have seen involved large unauthorised transfers from multiple accounts, not skimming a pound/dollar here and there.

There is no such thing as a secure computer unless you pull out the network cards and all the USB ports, weld the case shut and encrypt the hard drive with 2056bit encryption and prevent a human being from going anywhere near the keyboard :p lol.