Heartbleed - Wikipedia Heartbleed For other uses, see Heartbleed ( disambiguation ). Logo representing Heartbleed. Security company Codenomicon gave Heartbleed both a name and a logo, contributing to public awareness of the issue. Heartbleed is a security bug in the OpenSSL cryptography library, which is a widely used implementation of the Transport Layer Security ( TLS ) protocol. It was introduced into the software in 2012 and publicly disclosed in April 2014. Heartbleed may be exploited regardless of whether the vulnerable OpenSSL instance is running as a TLS server or client. It results from improper input validation ( due to a missing bounds check ) in the implementation of the TLS heartbeat extension, thus the bug 's name derives from heartbeat. The vulnerability is classified as a buffer over-read, a situation where more data can be read than should be allowed. Heartbleed is registered in the Common Vulnerabilities and Exposures database as CVE - 2014 - 0160. The federal Canadian Cyber Incident Response Centre issued a security bulletin advising system administrators about the bug. A fixed version of OpenSSL was released on April 7, 2014, on the same day Heartbleed was publicly disclosed. As of May 20, 2014, 1.5 % of the 800,000 most popular TLS - enabled websites were still vulnerable to Heartbleed. TLS implementations other than OpenSSL, such as GnuTLS, Mozilla 's Network Security Services, and the Windows platform implementation of TLS, were not affected because the defect existed in the OpenSSL 's implementation of TLS rather than in the protocol itself. Contents 1 History 1.1 Discovery 1.2 Bugfix and deployment 1.3 Certificate renewal and revocation 1.4 Exploitation 1.4. 1 Possible prior knowledge and exploitation 2 Behavior 2.1 Affected OpenSSL installations 2.1. 1 Vulnerable program and function 2.2 Patch 3 Impact 3.1 Client - side vulnerability 3.2 Specific systems affected 3.2. 1 Websites and other online services 3.2. 2 Software applications 3.2. 3 Operating systems / firmware 3.3 Vulnerability testing services 4 Remediation 4.1 Browser security certificate revocation awareness 5 Root causes, possible lessons, and reactions 6 References 7 Further reading 8 External links History The Heartbeat Extension for the Transport Layer Security ( TLS ) and Datagram Transport Layer Security ( DTLS ) protocols was proposed as a standard in February 2012 by RFC 6520. It provides a way to test and keep alive secure communication links without the need to renegotiate the connection each time. In 2011, one of the RFC 's authors, Robin Seggelmann, then a Ph. D. student at the Fachhochschule Münster, implemented the Heartbeat Extension for OpenSSL. Following Seggelmann 's request to put the result of his work into OpenSSL, his change was reviewed by Stephen N. Henson, one of OpenSSL 's four core developers. Henson failed to notice a bug in Seggelmann 's implementation, and introduced the flawed code into OpenSSL 's source code repository on December 31, 2011. The defect spread with the release of OpenSSL version 1.0. 1 on March 14, 2012. Heartbeat support was enabled by default, causing affected versions to be vulnerable. Discovery According to Mark J. Cox of OpenSSL, Neel Mehta of Google 's security team secretly reported Heartbleed on April 1, 2014 11 : 09 UTC. The bug was named by an engineer at Codenomicon, a Finnish cyber security company that also created the bleeding heart logo and launched the domain heartbleed.com to explain the bug to the public. While Google 's security team reported Heartbleed to OpenSSL first, both Google and Codenomicon discovered it independently at approximately the same time. Codenomicon reports April 3, 2014 as their date of discovery and their date of notification of NCSC - FI for vulnerability coordination. At the time of disclosure, some 17 % ( around half a million ) of the Internet 's secure web servers certified by trusted authorities were believed to be vulnerable to the attack, allowing theft of the servers ' private keys and users ' session cookies and passwords. The Electronic Frontier Foundation, Ars Technica, and Bruce Schneier all deemed the Heartbleed bug catastrophic. Forbes cybersecurity columnist Joseph Steinberg wrote : Some might argue that Heartbleed is the worst vulnerability found ( at least in terms of its potential impact ) since commercial traffic began to flow on the Internet. A British Cabinet spokesman recommended that : People should take advice on changing passwords from the websites they use. Most websites have corrected the bug and are best placed to advise what action, if any, people need to take. On the day of disclosure, the Tor Project advised : If you need strong anonymity or privacy on the Internet, you might want to stay away from the Internet entirely for the next few days while things settle. The Sydney Morning Herald published a timeline of the discovery on April 15, 2014, showing that some organizations had been able to patch the bug before its public disclosure. In some cases, it is not clear how they found out. Bugfix and deployment Bodo Moeller and Adam Langley of Google prepared the fix for Heartbleed. The resulting patch was added to Red Hat 's issue tracker on March 21, 2014. Stephen N. Henson applied the fix to OpenSSL 's version control system on 7 April. The first fixed version, 1.0. 1g, was released on the same day. As of June 21, 2014, 309,197 public web servers remained vulnerable. Certificate renewal and revocation According to Netcraft, about 30,000 of the 500,000 + X. 509 certificates which could have been compromised due to Heartbleed had been reissued by April 11, 2014, although fewer had been revoked. By May 9, 2014, only 43 % of affected web sites had reissued their security certificates. In addition, 7 % of the reissued security certificates used the potentially compromised keys. Netcraft stated : By reusing the same private key, a site that was affected by the Heartbleed bug still faces exactly the same risks as those that have not yet replaced their SSL certificates. eWeek said, `` ( Heartbleed is ) likely to remain a risk for months, if not years, to come. '' Exploitation The Canada Revenue Agency reported a theft of Social Insurance Numbers belonging to 900 taxpayers, and said that they were accessed through an exploit of the bug during a 6 - hour period on April 8, 2014. After the discovery of the attack, the agency shut down its website and extended the taxpayer filing deadline from April 30 to May 5. The agency said it would provide credit protection services at no cost to anyone affected. On April 16, the RCMP announced they had charged a computer science student in relation to the theft with unauthorized use of a computer and mischief in relation to data. The UK parenting site Mumsnet had several user accounts hijacked, and its CEO was impersonated. The site later published an explanation of the incident saying it was due to Heartbleed and the technical staff patched it promptly. Anti-malware researchers also exploited Heartbleed to their own advantage in order to access secret forums used by cybercriminals. Studies were also conducted by deliberately setting up vulnerable machines. For example, on April 12, 2014, at least two independent researchers were able to steal private keys from an experimental server intentionally set up for that purpose by CloudFlare. Also, on April 15, 2014, J. Alex Halderman, a professor at University of Michigan, reported that his honeypot server, an intentionally vulnerable server designed to attract attacks in order to study them, had received numerous attacks originating from China. Halderman concluded that because it was a fairly obscure server, these attacks were probably sweeping attacks affecting large areas of the Internet. In August 2014, it was made public that the Heartbleed vulnerability enabled hackers to steal security keys from Community Health Systems, the second - biggest for - profit U.S. hospital chain in the United States, compromising the confidentiality of 4.5 million patient records. The breach happened a week after Heartbleed was first made public. Possible prior knowledge and exploitation Many major web sites patched the bug or disabled the Heartbeat Extension within days of its announcement, but it is unclear whether potential attackers were aware of it earlier and to what extent it was exploited. Based on examinations of audit logs by researchers, it has been reported that some attackers may have exploited the flaw for at least five months before discovery and announcement. Errata Security pointed out that a widely used non-malicious program called Masscan, introduced six months before Heartbleed 's disclosure, abruptly terminates the connection in the middle of handshaking in the same way as Heartbleed, generating the same server log messages, adding `` Two new things producing the same error messages might seem like the two are correlated, but of course, they are n't. '' According to Bloomberg News, two unnamed insider sources informed it that the United States ' National Security Agency had been aware of the flaw since shortly after its appearance but‍ -- ‌instead of reporting it‍ -- ‌kept it secret among other unreported zero - day vulnerabilities in order to exploit it for the NSA 's own purposes. The NSA has denied this claim, as has Richard A. Clarke, a member of the National Intelligence Review Group on Intelligence and Communications Technologies that reviewed the United States ' electronic surveillance policy ; he told Reuters on April 11, 2014 that the NSA had not known of Heartbleed. The allegation prompted the American government to make, for the first time, a public statement on its zero - day vulnerabilities policy, accepting the recommendation of the review group 's 2013 report that had asserted `` in almost all instances, for widely used code, it is in the national interest to eliminate software vulnerabilities rather than to use them for US intelligence collection '', and saying that the decision to withhold should move from the NSA to the White House. Behavior A depiction of Heartbleed The RFC 6520 Heartbeat Extension tests TLS / DTLS secure communication links by allowing a computer at one end of a connection to send a Heartbeat Request message, consisting of a payload, typically a text string, along with the payload 's length as a 16 - bit integer. The receiving computer then must send exactly the same payload back to the sender. The affected versions of OpenSSL allocate a memory buffer for the message to be returned based on the length field in the requesting message, without regard to the actual size of that message 's payload. Because of this failure to do proper bounds checking, the message returned consists of the payload, possibly followed by whatever else happened to be in the allocated memory buffer. Heartbleed is therefore exploited by sending a malformed heartbeat request with a small payload and large length field to the vulnerable party ( usually a server ) in order to elicit the victim 's response, permitting attackers to read up to 64 kilobytes of the victim 's memory that was likely to have been used previously by OpenSSL. Where a Heartbeat Request might ask a party to `` send back the four - letter word ' bird ' '', resulting in a response of `` bird '', a `` Heartbleed Request '' ( a malicious heartbeat request ) of `` send back the 500 - letter word ' bird ' '' would cause the victim to return `` bird '' followed by whatever 496 characters the victim happened to have in active memory. Attackers in this way could receive sensitive data, compromising the confidentiality of the victim 's communications. Although an attacker has some control over the disclosed memory block 's size, it has no control over its location, and therefore can not choose what content is revealed. Affected OpenSSL installations The affected versions of OpenSSL are OpenSSL 1.0. 1 through 1.0. 1f ( inclusive ). Subsequent versions ( 1.0. 1g and later ) and previous versions ( 1.0. 0 branch and older ) are not vulnerable. Installations of the affected versions are vulnerable unless OpenSSL was compiled with - DOPENSSL_NO_HEARTBEATS. Vulnerable program and function The vulnerable program source files are t1_lib. c and d1_both. c and the vulnerable functions are tls1_process_heartbeat ( ) and dtls1_process_heartbeat ( ). Patch The problem can be fixed by ignoring Heartbeat Request messages that ask for more data than their payload needs. Version 1.0. 1g of OpenSSL adds some bounds checks to prevent the buffer over-read. For example, the following test was introduced to determine whether a heartbeat request would trigger Heartbleed ; it silently discards malicious requests. if ( 1 + 2 + payload + 16 > s - > s3 - > rrec. length ) return 0 ; / * silently discard per RFC 6520 sec. 4 * / The version control system contains a complete list of changes. Impact The data obtained by a Heartbleed attack may include unencrypted exchanges between TLS parties likely to be confidential, including any form post data in users ' requests. Moreover, the confidential data exposed could include authentication secrets such as session cookies and passwords, which might allow attackers to impersonate a user of the service. An attack may also reveal private keys of compromised parties, which would enable attackers to decrypt communications ( future or past stored traffic captured via passive eavesdropping, unless perfect forward secrecy is used, in which case only future traffic can be decrypted if intercepted via man - in - the - middle attacks ). An attacker having gained authentication material may impersonate the material 's owner after the victim has patched Heartbleed, as long as the material is accepted ( for example, until the password is changed or the private key revoked ). Heartbleed therefore constitutes a critical threat to confidentiality. However, an attacker impersonating a victim may also alter data. Indirectly, Heartbleed 's consequences may thus go far beyond a confidentiality breach for many systems. A survey of American adults conducted in April 2014 showed that 60 percent had heard about Heartbleed. Among those using the Internet, 39 percent had protected their online accounts, for example by changing passwords or canceling accounts ; 29 percent believed their personal information was put at risk because of the Heartbleed bug ; and 6 percent believed their personal information had been stolen. Client - side vulnerability Although the bug received more attention due to the threat it represents for servers, TLS clients using affected OpenSSL instances are also vulnerable. In what The Guardian therefore dubbed Reverse Heartbleed, malicious servers are able to exploit Heartbleed to read data from a vulnerable client 's memory. Security researcher Steve Gibson said of Heartbleed that : It 's not just a server - side vulnerability, it 's also a client - side vulnerability because the server, or whomever you connect to, is as able to ask you for a heartbeat back as you are to ask them. The stolen data could contain usernames and passwords. Reverse Heartbleed affected millions of application instances. Some of the vulnerable applications are listed in the `` Software applications '' section below. Specific systems affected Cisco Systems has identified 78 of its products as vulnerable, including IP phone systems and telepresence ( video conferencing ) systems. Websites and other online services An analysis posted on GitHub of the most visited websites on April 8, 2014 revealed vulnerabilities in sites including Yahoo !, Imgur, Stack Overflow, Slate, and DuckDuckGo. The following sites have services affected or made announcements recommending that users update passwords in response to the bug : Akamai Technologies Amazon Web Services Ars Technica Bitbucket BrandVerity Freenode GitHub IFTTT Internet Archive Mojang Mumsnet PeerJ Pinterest Prezi Reddit Something Awful SoundCloud SourceForge SparkFun Stripe Tumblr All Wikimedia Foundation wikis ( including Wikipedia in all languages ) Wunderlist The Canadian federal government temporarily shut online services of the Canada Revenue Agency ( CRA ) and several government departments over Heartbleed bug security concerns. Platform maintainers like the Wikimedia Foundation advised their users to change passwords. The servers of LastPass were vulnerable, but due to additional encryption and forward secrecy, potential attacks were not able to exploit this bug. However, LastPass recommended that its users change passwords for vulnerable websites. The Tor Project recommended that Tor relay operators and hidden service operators revoke and generate fresh keys after patching OpenSSL, but noted that Tor relays use two sets of keys and that Tor 's multi-hop design minimizes the impact of exploiting a single relay. 586 relays later found to be susceptible to the Heartbleed bug were taken off - line as a precautionary measure. Game - related services including Steam, Minecraft, Wargaming.net, League of Legends, GOG.com, Origin, Sony Online Entertainment, Humble Bundle, and Path of Exile were affected and subsequently fixed. Software applications Vulnerable software applications include : Several Hewlett - Packard server applications, such as HP System Management Homepage ( SMH ) for Linux and Windows. Some versions of FileMaker 13 LibreOffice 4.2. 0 to 4.2. 2 ( fixed in 4.2. 3 ) LogMeIn claimed to have `` updated many products and parts of our services that rely on OpenSSL ''. Multiple McAfee products, in particular some versions of software providing anti-viral coverage for Microsoft Exchange, software firewalls, and McAfee Email and Web Gateways MySQL Workbench 6.1. 4 and earlier Oracle MySQL Connector / C 6.1. 0 - 6.1. 3 and Connector / ODBC 5.1. 13, 5.2. 5 - 5.2. 6, 5.3. 2 Oracle Big Data Appliance ( includes Oracle Linux 6 ) Primavera P6 Professional Project Management ( includes Primavera P6 Enterprise Project Portfolio Management ) WinSCP ( FTP client for Windows ) 5.5. 2 and some earlier versions ( only vulnerable with FTP over TLS / SSL, fixed in 5.5. 3 ) Multiple VMware products, including VMware ESXi 5.5, VMware Player 6.0, VMware Workstation 10 and the series of Horizon products, emulators and cloud computing suites Several other Oracle Corporation applications were affected. Operating systems / firmware Several GNU / Linux distributions were affected, including Debian ( and derivatives such as Linux Mint and Ubuntu ) and Red Hat Enterprise Linux ( and derivatives such as CentOS, Oracle Linux 6 and Amazon Linux ), as well as the following operating systems and firmware implementations : Android 4.1. 1, used in various portable devices. Chris Smith writes in Boy Genius Report that just this one version of Android is affected but that it is a popular version of Android ( Chitika claim 4.1. 1 is on 50 million devices ; Google describe it as less than 10 % of activated Android devices ). Other Android versions are not vulnerable as they either have heartbeats disabled or use an unaffected version of OpenSSL. Firmware for some AirPort base stations Firmware for some Cisco Systems routers Firmware for some Juniper Networks routers pfSense 2.1. 0 and 2.1. 1 ( fixed in 2.1. 2 ) DD - WRT versions between and including 19163 and 23881 ( fixed in 23882 ) Western Digital My Cloud product family firmware Vulnerability testing services Several services have been made available to test whether Heartbleed affects a given site. However, many services have been claimed to be ineffective for detecting the bug. The available tools include : Tripwire SecureScan AppCheck -- static binary scan, from Codenomicon Arbor Network 's Pravail Security Analytics Norton Safeweb Heartbleed Check Tool Heartbleed testing tool by a European IT security company Heartbleed Scanner by Italian cryptologist Filippo Valsorda Heartbleed Vulnerability Test by Cyberoam Critical Watch Free Online Heartbleed Tester Metasploit Heartbleed scanner module Heartbleed Server Scanner by Rehmann Lookout Mobile Security Heartbleed Detector, an app for Android devices that determines the OpenSSL version of the device and indicates whether the vulnerable heartbeat is enabled Heartbleed checker hosted by LastPass Online network range scanner for Heartbleed vulnerability by Pentest-Tools.com Official Red Hat offline scanner written in the Python language Qualys SSL Labs ' SSL Server Test which not only looks for the Heartbleed bug, but can also find other SSL / TLS implementation errors. Browser extensions, such as Chromebleed and FoxBleed SSL Diagnos CrowdStrike Heartbleed Scanner -- Scans routers, printers and other devices connected inside a network including intranet web sites. Netcraft Site Report -- indicates whether a website 's confidentiality could be jeopardized due to a past exploitation of Heartbleed by checking data from Netcraft 's SSL Survey to determine whether a site offered the heartbeat TLS Extension prior to the Heartbleed disclosure. The Netcraft Extensions for Chrome, Firefox and Opera also perform this check, whilst looking for potentially compromised certificates. Other security tools have added support for finding this bug. For example, Tenable Network Security wrote a plugin for its Nessus vulnerability scanner that can scan for this fault. The Nmap security scanner includes a Heartbleed detection script from version 6.45. Sourcefire has released Snort rules to detect Heartbleed attack traffic and possible Heartbleed response traffic. Open source packet analysis software such as Wireshark and tcpdump can identify Heartbleed packets using specific BPF packet filters that can be used on stored packet captures or live traffic. Remediation Vulnerability to Heartbleed is resolved by updating OpenSSL to a patched version ( 1.0. 1g or later ). OpenSSL can be used either as a standalone program, a dynamic shared object, or a statically - linked library ; therefore, the updating process can require restarting processes loaded with a vulnerable version of OpenSSL as well as re-linking programs and libraries that linked it statically. In practice this means updating packages that link OpenSSL statically, and restarting running programs to remove the in - memory copy of the old, vulnerable OpenSSL code. After the vulnerability is patched, server administrators must address the potential breach of confidentiality. Because Heartbleed allowed attackers to disclose private keys, they must be treated as compromised ; keypairs must be regenerated, and certificates that use them must be reissued ; the old certificates must be revoked. Heartbleed also had the potential to allow disclosure of other in - memory secrets ; therefore, other authentication material ( such as passwords ) should also be regenerated. It is rarely possible to confirm that a system which was affected has not been compromised, or to determine whether a specific piece of information was leaked. Since it is difficult or impossible to determine when a credential might have been compromised and how it might have been used by an attacker, certain systems may warrant additional remediation work even after patching the vulnerability and replacing credentials. For example, signatures made by keys that were in use with a vulnerable OpenSSL version might well have been made by an attacker ; this raises the possibility integrity has been violated, and opens signatures to repudiation. Validation of signatures and the legitimacy of other authentications made with a potentially compromised key ( such as client certificate use ) must be done with regard to the specific system involved. Browser Security certificate revocation awareness Since Heartbleed threatened the privacy of private keys, users of a website which was compromised could continue to suffer from Heartbleed 's effects until their browser is made aware of the certificate revocation or the compromised certificate expires. For this reason, remediation also depends on users making use of browsers that have up - to - date certificate revocation lists ( or OCSP support ) and honour certificate revocations. Root causes, possible lessons, and reactions Although evaluating the total cost of Heartbleed is difficult, eWEEK estimated US $500 million as a starting point. David A. Wheeler 's paper How to Prevent the next Heartbleed analyzes why Heartbleed was n't discovered earlier, and suggests several techniques which could have led to a faster identification, as well as techniques which could have reduced its impact. According to Wheeler, the most efficient technique which could have prevented Heartbleed is a test suite thoroughly performing robustness testing, i.e. testing that invalid inputs cause failures rather than successes. Wheeler highlights that a single general - purpose test suite could serve as a base for all TLS implementations. According to an article on The Conversation written by Robert Merkel, Heartbleed revealed a massive failure of risk analysis. Merkel thinks OpenSSL gives more importance to performance than to security, which no longer makes sense in his opinion. But Merkel considers that OpenSSL should not be blamed as much as OpenSSL users, who chose to use OpenSSL, without funding better auditing and testing. Merkel explains that two aspects determine the risk that more similar bugs will cause vulnerabilities. One, the library 's source code influences the risk of writing bugs with such an impact. Secondly, OpenSSL 's processes affect the chances of catching bugs quickly. On the first aspect, Merkel mentions the use of the C programming language as one risk factor which favored Heartbleed 's appearance, echoing Wheeler 's analysis. On the same aspect, Theo de Raadt, founder and leader of the OpenBSD and OpenSSH projects, has criticized the OpenSSL developers for writing their own memory management routines and thereby, he claims, circumventing OpenBSD C standard library exploit countermeasures, saying `` OpenSSL is not developed by a responsible team. '' Following Heartbleed 's disclosure, members of the OpenBSD project forked OpenSSL into LibreSSL. The author of the change which introduced Heartbleed, Robin Seggelmann, stated that he missed validating a variable containing a length and denied any intention to submit a flawed implementation. Following Heartbleed 's disclosure, Seggelmann suggested focusing on the second aspect, stating that OpenSSL is not reviewed by enough people. Although Seggelmann 's work was reviewed by an OpenSSL core developer, the review was also intended to verify functional improvements, a situation making vulnerabilities much easier to miss. OpenSSL core developer Ben Laurie claimed that a security audit of OpenSSL would have caught Heartbleed. Software engineer John Walsh commented : Think about it, OpenSSL only has two ( fulltime ) people to write, maintain, test, and review 500,000 lines of business critical code. The OpenSSL foundation 's president, Steve Marquess, said `` The mystery is not that a few overworked volunteers missed this bug ; the mystery is why it has n't happened more often. '' David A. Wheeler described audits as an excellent way to find vulnerabilities in typical cases, but noted that `` OpenSSL uses unnecessarily complex structures, which makes it harder to both humans and machines to review. '' He wrote : There should be a continuous effort to simplify the code, because otherwise just adding capabilities will slowly increase the software complexity. The code should be refactored over time to make it simple and clear, not just constantly add new features. The goal should be code that is `` obviously right '', as opposed to code that is so complicated that `` I ca n't see any problems ''. LibreSSL made a big code cleanup, removing more than 90,000 lines of C code just in its first week. According to security researcher Dan Kaminsky, Heartbleed is sign of an economic problem which needs to be fixed. Seeing the time taken to catch this simple error in a simple feature from a `` critical '' dependency, Kaminsky fears numerous future vulnerabilities if nothing is done. When Heartbleed was discovered, OpenSSL was maintained by a handful of volunteers, only one of whom worked full - time. Yearly donations to the OpenSSL project were about US $2,000. The Heartbleed website from Codenomicon advised money donations to the OpenSSL project. After learning about donations for the 2 or 3 days following Heartbleed 's disclosure totaling US $841, Kaminsky commented `` We are building the most important technologies for the global economy on shockingly underfunded infrastructure. '' Core developer Ben Laurie has qualified the project as `` completely unfunded ''. Although the OpenSSL Software Foundation has no bug bounty program, the Internet Bug Bounty initiative awarded US $15,000 to Google 's Neel Mehta, who discovered Heartbleed, for his responsible disclosure. Paul Chiusano suggested Heartbleed may have resulted from failed software economics. The industry 's collective response to the crisis was the Core Infrastructure Initiative, a multimillion - dollar project announced by the Linux Foundation on April 24, 2014 to provide funds to critical elements of the global information infrastructure. The initiative intends to allow lead developers to work full - time on their projects and to pay for security audits, hardware and software infrastructure, travel, and other expenses. OpenSSL is a candidate to become the first recipient of the initiative 's funding. After the discovery Google established Project Zero which is tasked with finding zero - day vulnerabilities to help secure the Web and society. References Jump up ^ McKenzie, Patrick ( April 9, 2014 ). `` What Heartbleed Can Teach The OSS Community About Marketing ''. Kalzumeus. Retrieved February 8, 2018. Jump up ^ Biggs, John ( April 9, 2014 ). `` Heartbleed, The First Security Bug With A Cool Logo ''. TechCrunch. Retrieved February 8, 2018. Jump up ^ `` Security Advisory -- OpenSSL Heartbleed Vulnerability ''. Cyberoam. April 11, 2014. Retrieved February 8, 2018. Jump up ^ Limer, Eric ( April 9, 2014 ). `` How Heartbleed Works : The Code Behind the Internet 's Security Nightmare ''. Retrieved November 24, 2014. ^ Jump up to : `` CVE - 2014 - 0160 ''. Common Vulnerabilities and Exposures. Mitre. Retrieved February 8, 2018. Jump up ^ `` CWE - 126 : Buffer Over-read ( 3.0 ) ''. Common Vulnerabilities and Exposures. Mitre. January 18, 2018. Retrieved February 8, 2018. Jump up ^ `` AL14 - 005 : OpenSSL Heartbleed Vulnerability ''. Cyber Security Bulletins. Public Safety Canada. April 11, 2014. Retrieved February 8, 2018. Jump up ^ Leyden, John ( May 20, 2014 ). `` AVG on Heartbleed : It 's dangerous to go alone. Take this ( an AVG tool ) ''. The Register. Retrieved February 8, 2018. Jump up ^ Pretorius, Tracey ( April 10, 2014 ). `` Microsoft Services unaffected by OpenSSL `` Heartbleed '' vulnerability ``. Microsoft. Retrieved February 8, 2018. Jump up ^ Seggelmann, Robin ; Tuexen, Michael ; Williams, Michael ( February 2012 ). Transport Layer Security ( TLS ) and Datagram Transport Layer Security ( DTLS ) Heartbeat Extension. IETF. doi : 10.17487 / RFC6520. ISSN 2070 - 1721. RFC 6520. https://tools.ietf.org/html/rfc6520. Retrieved February 8, 2018. ^ Jump up to : Grubb, Ben ( April 11, 2014 ). `` Man who introduced serious ' Heartbleed ' security flaw denies he inserted it deliberately ''. The Sydney Morning Herald. Jump up ^ `` # 2658 : ( PATCH ) Add TLS / DTLS Heartbeats ''. OpenSSL. 2011. Jump up ^ `` Meet the man who created the bug that almost broke the Internet ''. Globe and Mail. April 11, 2014. ^ Jump up to : `` Heartbleed Bug ''. April 8, 2014. Jump up ^ Goodin, Dan ( April 8, 2014 ). `` Critical crypto bug in OpenSSL opens two - thirds of the Web to eavesdropping ''. Ars Technica. ^ Jump up to : Bar - El, Hagai ( April 9, 2014 ). `` OpenSSL `` Heartbleed '' bug : what 's at risk on the server and what is not ``. Jump up ^ `` Mark J Cox -- # Heartbleed ''. Retrieved April 12, 2014. Jump up ^ Dewey, Caitlin. `` Why is it called the ' Heartbleed Bug ' ? ''. Retrieved November 25, 2014. Jump up ^ Lee, Timothy B. ( 2014 - 04 - 10 ). `` Who discovered the vulnerability ? ''. Vox. Retrieved 2017 - 12 - 04. Jump up ^ Lee, Ariana ( 2014 - 04 - 13 ). `` How Codenomicon Found The Heartbleed Bug Now Plaguing The Internet - ReadWrite ''. ReadWrite. Retrieved 2017 - 12 - 04. Discovered independently by Google engineer Neel Mehta and the Finnish security firm Codenomicon, Heartbleed has been called `` one of the most serious security problems to ever affect the modern web. '' Jump up ^ `` Näin suomalaistutkijat löysivät vakavan vuodon internetin sydämestä -- transl / Finnish researchers found a serious leakage of the heart of the Internet ''. April 10, 2014. Retrieved April 13, 2014. Jump up ^ Mutton, Paul ( April 8, 2014 ). `` Half a million widely trusted websites vulnerable to Heartbleed bug ''. Netcraft Ltd. Retrieved November 24, 2014. Jump up ^ Perlroth, Nicole ; Hardy, Quentin ( April 11, 2014 ). `` Heartbleed Flaw Could Reach to Digital Devices, Experts Say ''. New York Times. Jump up ^ Chen, Brian X. ( April 9, 2014 ). `` Q. and A. on Heartbleed : A Flaw Missed by the Masses ''. New York Times. Jump up ^ Wood, Molly ( April 10, 2014 ). `` Flaw Calls for Altering Passwords, Experts Say ''. New York Times. Jump up ^ Manjoo, Farhad ( April 10, 2014 ). `` Users ' Stark Reminder : As Web Grows, It Grows Less Secure ''. New York Times. Jump up ^ Zhu, Yan ( April 8, 2014 ). `` Why the Web Needs Perfect Forward Secrecy More Than Ever ''. Electronic Frontier Foundation. Jump up ^ Goodin, Dan ( April 8, 2014 ). `` Critical crypto bug exposes Yahoo Mail, other passwords Russian roulette - style ''. Ars Technica. Jump up ^ `` Schneier on Security : Heartbleed ''. Schneier on Security. April 11, 2014. Jump up ^ Joseph Steinberg ( April 10, 2014 ). `` Massive Internet Security Vulnerability -- Here 's What You Need To Do ''. Forbes. Jump up ^ Kelion, Leo ( April 11, 2014 ). `` BBC News -- US government warns of Heartbleed bug danger ''. BBC. ^ Jump up to : `` OpenSSL bug CVE - 2014 - 0160 ''. Tor Project. April 7, 2014. Jump up ^ Grubb, Ben ( 2014 - 04 - 14 ), `` Heartbleed disclosure timeline : who knew what and when '', The Sydney Morning Herald, retrieved November 25, 2014 Jump up ^ `` heartbeat_fix ''. Retrieved April 14, 2014. ^ Jump up to : `` '' complete list of changes '' ( Git -- openssl. git / commitdiff ) ``. The OpenSSL Project. April 7, 2014. Retrieved April 10, 2014. Jump up ^ Graham, Robert ( 2014 - 06 - 21 ). `` 300k servers vulnerable to Heartbleed two months later ''. Errata Security. Retrieved 2014 - 06 - 22. Jump up ^ `` Heartbleed certificate revocation tsunami yet to arrive ''. Netcraft. April 11, 2014. Retrieved April 24, 2014. Jump up ^ Paul Mutton ( 9 May 2014 ). `` Keys left unchanged in many Heartbleed replacement certificates ! ''. Netcraft. Retrieved 11 September 2016. Jump up ^ Sean Michael Kerner ( 2014 - 05 - 10 ). `` Heartbleed Still a Threat to Hundreds of Thousands of Servers ''. eWEEK. Jump up ^ Evans, Pete ( April 14, 2014 ), Heartbleed bug : 900 SINs stolen from Revenue Canada, CBC News Some of the details are in the video linked from the page. Jump up ^ `` Canada Revenue Agency pushes tax deadline to May 5 after Heartbleed bug ''. Apr 14, 2014. Retrieved 4 November 2014. Jump up ^ Thibedeau, Hannah ( April 16, 2014 ). `` Heartbleed bug accused charged by RCMP after SIN breach ''. CBC News. Jump up ^ `` Heartbleed hack case sees first arrest in Canada ''. BBC News. April 16, 2014. ^ Jump up to : Kelion, Leo ( 2014 - 04 - 14 ). `` BBC News -- Heartbleed hacks hit Mumsnet and Canada 's tax agency ''. BBC News. Jump up ^ `` Mumsnet and Heartbleed as it happened ''. Mumsnet. Jump up ^ Ward, Mark ( 2014 - 04 - 29 ). `` Heartbleed used to uncover data from cyber-criminals ''. BBC News. Jump up ^ Lawler, Richard ( April 11, 2014 ). `` Cloudflare Challenge proves ' worst case scenario ' for Heartbleed is actually possible ''. Engadget. Jump up ^ `` The Heartbleed Challenge ''. CloudFlare. 2014. Archived from the original on April 12, 2014. Jump up ^ Robertson, Jordan ( 2014 - 04 - 16 ). `` Hackers from China waste little time in exploiting Heartbleed ''. The Sydney Morning Herald. Jump up ^ Sam Frizell. `` Time Magazine : Report : Devastating Heartbleed Flaw Was Used in Hospital Hack ''. Retrieved October 7, 2014. Jump up ^ Cipriani, Jason ( April 9, 2014 ). `` Heartbleed bug : Check which sites have been patched ''. CNET. Jump up ^ Gallagher, Sean ( April 9, 2014 ). `` Heartbleed vulnerability may have been exploited months before patch ''. Ars Technica. Jump up ^ Eckersley, Peter. `` Wild at Heart : Were Intelligence Agencies Using Heartbleed in November 2013 ? ''. Eff.org. Retrieved 25 November 2014. Jump up ^ Graham, Robert ( April 9, 2014 ). `` No, we were n't scanning for hearbleed before April 7 ''. Errata Security. Jump up ^ Riley, Michael ( 2014 - 04 - 12 ). `` NSA Said to Exploit Heartbleed Bug for Intelligence for Years ''. Bloomberg L.P. Jump up ^ Molina, Brett. `` Report : NSA exploited Heartbleed for years ''. USA Today. Retrieved April 11, 2014. Jump up ^ Riley, Michael. `` NSA exploited Heartbleed bug for two years to gather intelligence, sources say ''. Financial Post. Retrieved April 11, 2014. Jump up ^ `` Statement on Bloomberg News story that NSA knew about the ' Heartbleed bug ' flaw and regularly used it to gather critical intelligence ''. National Security Agency. April 11, 2014. Jump up ^ Mark Hosenball ; Will Dunham ( April 11, 2014 ). `` White House, spy agencies deny NSA exploited ' Heartbleed ' bug ''. Reuters. Jump up ^ Zetter, Kim. `` U.S. Gov Insists It Does n't Stockpile Zero - Day Exploits to Hack Enemies ''. wired.com. Retrieved 25 November 2014. Jump up ^ Hunt, Troy ( April 9, 2014 ). `` Everything you need to know about the Heartbleed SSL bug ''. Jump up ^ `` git.openssl.org Git -- openssl. git / log ''. git.openssl.org. Archived from the original on April 15, 2014. Retrieved November 25, 2014. Jump up ^ `` Spiceworks Community Discussions ''. community.spiceworks.com. Retrieved April 11, 2014. Jump up ^ The OpenSSL Project ( April 7, 2014 ). `` OpenSSL Security Advisory ( 07 Apr 2014 ) ''. Jump up ^ `` OpenSSL versions and vulnerability ( 9 April 2014 ) ''. Retrieved 9 April 2014. Jump up ^ `` Cyberoam Users Need not Bleed over Heartbleed Exploit ''. cyberoam.com. Archived from the original on April 15, 2014. Retrieved April 11, 2014. Jump up ^ `` tls1_process_heartbeat ( 9 April 2014 ) ''. Retrieved 10 April 2014. Jump up ^ `` Why Heartbleed is dangerous ? Exploiting CVE - 2014 - 0160 ''. IPSec.pl. 2014. Jump up ^ John Graham - Cumming ( 2014 - 04 - 28 ). `` Searching for The Prime Suspect : How Heartbleed Leaked Private Keys ''. CloudFlare. Retrieved 2014 - 06 - 07. Jump up ^ Judge, Kevin. `` Servers Vulnerable to Heartbleed ( 14 July 2014 ) ''. Retrieved 25 Aug 2014. Jump up ^ Lee Rainie ; Maeve Duggan ( 2014 - 04 - 30 ). `` Heartbleed 's Impact ''. Pew Research Internet Project. Pew Research Center. p. 2. Jump up ^ Bradley, Tony ( 2014 - 04 - 14 ). `` Reverse Heartbleed puts your PC and devices at risk of OpenSSL attack ''. PCWorld. IDG Consumer & SMB. ^ Jump up to : Charles Arthur ( 2014 - 04 - 15 ). `` Heartbleed makes 50m Android phones vulnerable, data shows ''. The Guardian. Guardian News and Media Limited. Jump up ^ `` Security Now 451 ''. Twit.Tv. Retrieved 2014 - 04 - 19. Jump up ^ Ramzan, Zulfikar ( 2014 - 04 - 24 ). `` ' Reverse Heartbleed ' can attack PCs and mobile phones ''. SC Magazine. Haymarket Media, Inc. ^ Jump up to : `` OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products ''. Cisco Systems. 2014 - 04 - 09. Jump up ^ `` heartbleed - masstest : Overview ''. GitHub. Retrieved 2014 - 04 - 19. Jump up ^ Cipriani, Jason ( April 10, 2014 ). `` Which sites have patched the Heartbleed bug ? ''. CNET. Retrieved April 10, 2014. Jump up ^ `` Heartbleed FAQ : Akamai Systems Patched ''. Akamai Technologies. April 8, 2014. Jump up ^ `` AWS Services Updated to Address OpenSSL Vulnerability ''. Amazon Web Services. April 8, 2014. Jump up ^ `` Dear readers, please change your Ars account passwords ASAP ''. Ars Technica. April 8, 2014. Jump up ^ `` All Heartbleed upgrades are now complete ''. BitBucket Blog. April 9, 2014. Jump up ^ `` Keeping Your BrandVerity Account Safe from the Heartbleed Bug ''. BrandVerity Blog. April 9, 2014. Jump up ^ `` Twitter / freenodestaff : we 've had to restart a bunch... '' April 8, 2014. Jump up ^ `` Security : Heartbleed vulnerability ''. GitHub. April 8, 2014. Jump up ^ `` IFTTT Says It Is ' No Longer Vulnerable ' To Heartbleed ''. LifeHacker. April 8, 2014. Jump up ^ `` Heartbleed bug and the Archive Internet Archive Blogs ''. Blog.archive.org. April 9, 2014. Retrieved April 14, 2014. Jump up ^ `` Twitter / KrisJelbring : If you logged in to any of ''. Twitter.com. April 8, 2014. Retrieved April 14, 2014. Jump up ^ `` The widespread OpenSSL ' Heartbleed ' bug is patched in PeerJ ''. PeerJ. April 9, 2014. Jump up ^ `` Was Pinterest impacted by the Heartbleed issue ? ''. Help Center. Pinterest. Retrieved April 20, 2014. Jump up ^ `` Heartbleed Defeated ''. Archived from the original on June 5, 2014. Retrieved April 13, 2014. Jump up ^ Staff ( April 14, 2014 ). `` We recommend that you change your reddit password ''. Reddit. Retrieved April 14, 2014. Jump up ^ `` IMPORTANT ANNOUNCEMENTS FROM THE MAKERS OF CHILI ''. Retrieved April 13, 2014. Jump up ^ Codey, Brendan ( April 9, 2014 ). `` Security Update : We 're going to sign out everyone today, here 's why ''. SoundCloud. Jump up ^ `` SourceForge response to Heartbleed ''. SourceForge. April 10, 2014. Jump up ^ `` Heartbleed ''. SparkFun. April 9, 2014. Jump up ^ `` Heartbleed ''. Stripe ( company ). April 9, 2014. Retrieved April 10, 2014. Jump up ^ `` Tumblr Staff - Urgent security update ''. April 8, 2014. Retrieved April 9, 2014. Jump up ^ Hern, Alex ( April 9, 2014 ). `` Heartbleed : do n't rush to update passwords, security experts warn ''. The Guardian. ^ Jump up to : Grossmeier, Greg ( April 8, 2014 ). `` ( Wikitech - l ) Fwd : Security precaution -- Resetting all user sessions today ''. Wikimedia Foundation. Retrieved April 9, 2014. Jump up ^ Grossmeier, Greg ( April 10, 2014 ). `` Wikimedia 's response to the `` Heartbleed '' security vulnerability ``. Wikimedia Foundation blog. Wikimedia Foundation. Retrieved April 10, 2014. Jump up ^ `` Wunderlist & the Heartbleed OpenSSL Vulnerability ''. April 10, 2014. Jump up ^ `` Security concerns prompts tax agency to shut down website ''. CTV News. April 9, 2014. Retrieved April 9, 2014. Jump up ^ `` Heartbleed : Canadian tax services back online ''. CBC News. Retrieved April 14, 2014. Jump up ^ Fiegerman, Seth ( April 14, 2014 ). `` The Heartbleed Effect : Password Services Are Having a Moment ''. Mashable. Jump up ^ `` LastPass and the Heartbleed Bug ''. LastPass. April 8, 2014. Retrieved April 28, 2014. Jump up ^ `` ( tor - relays ) Rejecting 380 vulnerable guard / exit keys ''. Lists.torproject.org. Retrieved 2014 - 04 - 19. Jump up ^ `` Tor Weekly News -- April 16th, 2014 The Tor Blog ''. Blog.torproject.org. Retrieved 2014 - 04 - 19. Jump up ^ Gallagher, Sean ( 2012 - 05 - 17 ). `` Tor network 's ranks of relay servers cut because of Heartbleed bug ''. Ars Technica. Retrieved 2014 - 04 - 19. Jump up ^ Mimoso, Michael. `` Tor Blacklisting Exit Nodes Vulnerable to Heartbleed Bug Threatpost The first stop for security news ''. Threatpost. Retrieved 2014 - 04 - 19. Jump up ^ Paul Younger ( 2014 - 04 - 11 ). `` PC game services affected by Heartbleed and actions you need to take ''. IncGamers. Jump up ^ `` HP Servers Communication : OpenSSL `` HeartBleed '' Vulnerability ``. April 18, 2014. Archived from the original on March 4, 2016. Jump up ^ `` FileMaker products and the Heartbleed bug ''. May 6, 2014. Jump up ^ italovignoli ( April 10, 2014 ). `` LibreOffice 4.2. 3 is now available for download ''. The Document Foundation. Archived from the original on April 12, 2014. Retrieved April 11, 2014. Jump up ^ `` CVE - 2014 - 0160 ''. LibreOffice. April 7, 2014. Retrieved May 2, 2014. Jump up ^ `` LogMeIn and OpenSSL ''. LogMeIn. Retrieved April 10, 2014. Jump up ^ `` McAfee Security Bulletin -- OpenSSL Heartbleed vulnerability patched in McAfee products ''. McAfee KnowledgeBase. McAfee. 2014 - 04 - 17. ^ Jump up to : `` OpenSSL Security Bug - Heartbleed / CVE - 2014 - 0160 ''. Retrieved 12 May 2014. Jump up ^ `` Recent Version History ''. WinSCP. April 14, 2014. Retrieved May 2, 2014. Jump up ^ `` Response to OpenSSL security issue CVE - 2014 - 0160 / CVE - 2014 - 0346 a.k.a : `` Heartbleed '' ``. VMware, Inc. Retrieved 2014 - 04 - 17. Jump up ^ `` DSA - 2896 - 1 openssl -- security update ''. The Debian Project. April 7, 2014. Jump up ^ `` Ubuntu Security Notice USN - 2165 - 1 ''. Canonical, Ltd. April 7, 2014. Retrieved April 17, 2014. Jump up ^ `` Important : openssl security update ''. Red Hat, Inc. April 8, 2014. Jump up ^ `` Karanbir Singh 's posting to CentOS - announce ''. centos.org. April 8, 2014. Jump up ^ `` Amazon Linux AMI Security Advisory : ALAS - 2014 - 320 ''. Amazon Web Services, Inc. April 7, 2014. Retrieved April 17, 2014. Jump up ^ `` Android 4.1. 1 devices vulnerable to Heartbleed bug, says Google ''. NDTV Convergence. 2014 - 04 - 14. Jump up ^ `` Around 50 million Android smartphones are still vulnerable to the Heartbleed Bug ''. Fox News. 2014 - 04 - 17. Jump up ^ `` Heartbleed : Android 4.1. 1 Jelly Bean could be seriously affected ''. BGR Media. 2014 - 04 - 16. Jump up ^ Blaich, Andrew ( April 8, 2014 ). `` Heartbleed Bug Impacts Mobile Devices ''. Bluebox. Archived from the original on May 6, 2014. Jump up ^ Snell, Jason ( 2014 - 04 - 22 ). `` Apple releases Heartbleed fix for AirPort Base Stations ''. Macworld. Jump up ^ Kleinman, Alexis ( April 11, 2014 ). `` The Heartbleed Bug Goes Even Deeper Than We Realized -- Here 's What You Should Do ''. The Huffington Post. ^ Jump up to : Yadron, Danny ( 2014 - 04 - 10 ). `` Heartbleed Bug Found in Cisco Routers, Juniper Gear ''. Dow Jones & Company, Inc. Jump up ^ `` 2014 - 04 Out of Cycle Security Bulletin : Multiple products affected by OpenSSL `` Heartbleed '' issue ( CVE - 2014 - 0160 ) ``. Juniper Networks. 2014 - 04 - 14. Jump up ^ `` OpenSSL `` Heartbleed '' Information Disclosure, ECDSA ``. Electric Sheep Fencing LLC. April 8, 2014. Retrieved May 2, 2014. Jump up ^ `` OpenVPN affected by OpenSSL bug CVE - 2014 - 016 ? ''. DD - WRT Forum. Retrieved 26 February 2017. Jump up ^ `` Heartbleed Bug Issue ''. Western Digital. April 10, 2014. Archived from the original on April 19, 2014. Jump up ^ Brewster, Tom ( 2014 - 04 - 16 ). `` Heartbleed : 95 % of detection tools ' flawed ', claim researchers ''. The Guardian. Guardian News and Media Limited. Jump up ^ `` Tripwire SecureScan ''. Tripwire -- Take Control of IT Security and Regulatory Compliance with Tripwire Software. Retrieved October 7, 2014. Jump up ^ `` AppCheck -- static binary scan, from Codenomicon ''. Archived from the original on October 17, 2014. Retrieved October 7, 2014. Jump up ^ `` Arbor Network 's Pravail Security Analytics ''. Archived from the original on April 11, 2014. Retrieved October 7, 2014. Jump up ^ `` Norton Safeweb Heartbleed Check Tool ''. Retrieved October 7, 2014. Jump up ^ `` Heartbleed OpenSSL extension testing tool, CVE - 2014 - 0160 ''. Possible.lv. Retrieved April 11, 2014. Jump up ^ `` Test your server for Heartbleed ( CVE - 2014 - 0160 ) ''. Retrieved 25 November 2014. Jump up ^ `` Cyberoam Security Center ''. Archived from the original on 15 April 2014. Retrieved 25 November 2014. Jump up ^ `` Critical Watch : : Heartbleed Tester : : CVE - 2014 - 0160 ''. Heartbleed.criticalwatch.com. Archived from the original on April 14, 2014. Retrieved April 14, 2014. Jump up ^ `` metasploit - framework / openssl_heartbleed. rb at master ''. Retrieved 25 November 2014. Jump up ^ `` OpenSSL Heartbeat Vulnerability Check ( Heartbleed Checker ) ''. Retrieved 25 November 2014. Jump up ^ `` Heartbleed Detector : Check If Your Android OS Is Vulnerable with Our App ''. Lookout Mobile Security blog. April 9, 2014. Retrieved April 10, 2014. Jump up ^ `` Heartbleed checker ''. LastPass. Retrieved April 11, 2014. Jump up ^ `` OpenSSL Heartbleed vulnerability scanner : : Online Penetration Testing Tools Ethical Hacking Tools ''. Pentest-tools.com. Retrieved April 11, 2014. Jump up ^ Stafford, Jared ( 2014 - 04 - 14 ). `` heartbleed-poc.py ''. Red Hat, Inc. Jump up ^ `` Qualys 's SSL Labs ' SSL Server Test ''. Retrieved October 7, 2014. Jump up ^ `` Chromebleed ''. Retrieved October 7, 2014. Jump up ^ `` FoxBleed ''. Retrieved October 7, 2014. Jump up ^ `` SSL Diagnos ''. SourceForge. Retrieved October 7, 2014. Jump up ^ `` CrowdStrike Heartbleed Scanner ''. Retrieved October 7, 2014. Jump up ^ Lynn, Samara. `` Routers, SMB Networking Equipment -- Is Your Networking Device Affected by Heartbleed ? ''. PCMag.com. Retrieved 2014 - 04 - 24. Jump up ^ `` Netcraft Site Report ''. Retrieved October 7, 2014. Jump up ^ `` Netcraft Extensions ''. Retrieved October 7, 2014. Jump up ^ Mutton, Paul ( June 24, 2014 ). `` Netcraft Releases Heartbleed Indicator For Chrome, Firefox and Opera ''. Netcraft. Jump up ^ Mann, Jeffrey ( April 9, 2014 ). `` Tenable Facilitates Detection of OpenSSL Vulnerability Using Nessus and Nessus Perimeter Service ''. Tenable Network Security. Jump up ^ `` Nmap 6.45 Informal Release ''. April 12, 2014. Jump up ^ `` VRT : Heartbleed Memory Disclosure -- Upgrade OpenSSL Now ! ''. April 8, 2014. Jump up ^ `` Blogs How to Detect a Prior Heartbleed Exploit ''. Riverbed. 2014 - 04 - 09. Jump up ^ `` Patched Servers Remain Vulnerable to Heartbleed OpenSSL Hayden James ''. Haydenjames.io. Retrieved April 10, 2014. Jump up ^ `` Security Certificate Revocation Awareness -- Specific Implementations ''. Gibson Research Corporation. Retrieved 2014 - 06 - 07. Jump up ^ Sean Michael Kerner ( 2014 - 04 - 19 ). `` Heartbleed SSL Flaw 's True Cost Will Take Time to Tally ''. eWEEK. ^ Jump up to : A. Wheeler, David ( 2014 - 04 - 29 ). `` How to Prevent the next Heartbleed ''. Jump up ^ Merkel, Robert ( 2014 - 04 - 11 ). `` How the Heartbleed bug reveals a flaw in online security ''. The Conversation. Jump up ^ `` Re : FYA : http : heartbleed.com ''. Gmane. Retrieved April 11, 2014. Jump up ^ `` Theo De Raadt 's Small Rant On OpenSSL ''. Slashdot. Dice. 2014 - 04 - 10. Jump up ^ `` OpenBSD has started a massive strip - down and cleanup of OpenSSL ''. OpenBSD journal. 2014 - 04 - 15. Jump up ^ Lia Timson ( April 11, 2014 ). `` Who is Robin Seggelmann and did his Heartbleed break the internet ? ''. The Sydney Morning Herald. Jump up ^ Williams, Chris ( April 11, 2014 ). `` OpenSSL Heartbleed : Bloody nose for open - source bleeding hearts ''. The Register. Jump up ^ Smith, Gerry ( 2014 - 04 - 10 ). `` How The Internet 's Worst Nightmare Could Have Been Avoided ''. The Huffington Post. The bug revealed this week was buried inside 10 lines of code and would have been spotted in an audit, according to Laurie, who works on the security team at Google. Jump up ^ John Walsh ( 30 April 2014 ). `` Free Can Make You Bleed ''. ssh communications security. Retrieved 11 September 2016. Jump up ^ Walsh, John ( 2014 - 04 - 30 ). `` Free Can Make You Bleed ''. SSH Communications Security. Jump up ^ Seltzer, Larry ( April 21, 2014 ). `` OpenBSD forks, prunes, fixes OpenSSL ''. Zero Day. ZDNet. Retrieved April 21, 2014. Jump up ^ Pagliery, Jose ( 2014 - 04 - 18 ). `` Your Internet security relies on a few volunteers ''. CNNMoney. Cable News Network. ^ Jump up to : Perlroth, Nicole ( 2014 - 04 - 18 ). `` Heartbleed Highlights a Contradiction in the Web ''. The New York Times. The New York Times Company. Jump up ^ Kaminsky, Dan ( 2014 - 04 - 10 ). `` Be Still My Breaking Heart ''. Dan Kaminsky 's Blog. Jump up ^ Chiusano, Paul ( 2014 - 12 - 08 ). `` The failed economics of our software commons, and what you can about it right now ''. Paul Chiusano 's blog. ^ Jump up to : `` Amazon Web Services, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, VMware and The Linux Foundation Form New Initiative to Support Critical Open Source Projects ''. The Linux Foundation. 2014 - 04 - 24. Jump up ^ Paul, Ian ( 2014 - 04 - 24 ). `` In Heartbleed 's wake, tech titans launch fund for crucial open - source projects ''. PCWorld. Jump up ^ `` Google Project Zero aims to keep the Heartbleed Bug from happening again ''. TechRadar. Retrieved 9 April 2017. Further reading Durumeric, Zakir ; et al. ( 2014 ). `` The Matter of Heartbleed ''. Proceedings of the 2014 Conference on Internet Measurement Conference : 475 -- 488. doi : 10.1145 / 2663716.2663755. External links Find more aboutHeartbleedat Wikipedia 's sister projects Definitions from Wiktionary Media from Wikimedia Commons Learning resources from Wikiversity Data from Wikidata Summary and Q&A about the bug by Codenomicon Ltd Information for Canadian organizations and individuals Hacking in the 2010s ← 2000s Timeline 2020s → Major incidents Australian cyberattacks Operation Aurora Operation Payback 2011 DigiNotar HBGary Federal Operation AntiSec Operation Tunisia PlayStation RSA SecurID compromise 2012 LinkedIn hack Stratfor email leak 2013 South Korea cyberattack Snapchat hack 2013 Yahoo ! data breach 2014 Anthem medical data breach Operation Tovar iCloud leaks of celebrity photos Sony Pictures hack Russian hacker password theft 2014 Yahoo ! data breach 2015 Office of Personnel Management data breach Hacking Team Ashley Madison data breach VTech data breach SWIFT banking hack 2016 Bangladesh Bank robbery Hollywood Presbyterian Medical Center ransomware incident Commission on Elections data breach Democratic National Committee cyber attacks DCCC cyber attacks Dyn cyberattack Russian interference in U.S. election 2017 WannaCry ransomware attack Westminster cyberattack Petya cyberattack 2017 cyberattacks on Ukraine Equifax data breach Deloitte breach Disqus breach 2018 Trustico Exactis Groups Anonymous associated events Bureau 121 Cozy Bear CyberBerkut Derp Equation Group Fancy Bear GNAA Goatse Security Guccifer 2.0 Hacking Team Iranian Cyber Army Lizard Squad LulzRaft LulzSec New World Hackers NullCrew NSO Group PayPal 14 PLA Unit 61398 PLATINUM Pranknet RedHack Rocket Kitten The Shadow Brokers Syrian Electronic Army TeaMp0isoN Tailored Access Operations UGNazi Yemen Cyber Army Individuals George Hotz Guccifer Hector Monsegur Jeremy Hammond Junaid Hussain Kristoffer von Hassel Mustafa Al - Bassam MLT Ryan Ackroyd Topiary The Jester weev Major vulnerabilities publicly disclosed Evercookie ( 2010 ) iSeeYou ( 2013 ) Heartbleed ( 2014 ) Shellshock ( 2014 ) POODLE ( 2014 ) Rootpipe ( 2014 ) Row hammer ( 2014 ) JASBUG ( 2015 ) Stagefright ( 2015 ) DROWN ( 2016 ) Badlock ( 2016 ) Dirty COW ( 2016 ) Cloudbleed ( 2017 ) Broadcom Wi - Fi ( 2017 ) EternalBlue ( 2017 ) DoublePulsar ( 2017 ) Silent Bob is Silent ( 2017 ) KRACK ( 2017 ) ROCA vulnerability ( 2017 ) BlueBorne ( 2017 ) Meltdown ( 2018 ) Spectre ( 2018 ) EFAIL ( 2018 ) Speculative Store Bypass ( 2018 ) Lazy FP State Restore ( 2018 ) TLBleed ( 2018 ) Malware Bad Rabbit Careto / The Mask CryptoLocker Dexter Duqu Duqu 2.0 FinFisher Flame Gameover ZeuS Mahdi Metulji botnet Mirai NSA ANT catalog Pegasus Petya R2D2 Shamoon Stars virus Stuxnet Vault 7 WannaCry X-Agent TLS and SSL Protocols and technologies Transport Layer Security / Secure Sockets Layer ( TLS / SSL ) Datagram Transport Layer Security ( DTLS ) Server Name Indication ( SNI ) Application - Layer Protocol Negotiation ( ALPN ) DNS - based Authentication of Named Entities ( DANE ) DNS Certification Authority Authorization ( CAA ) HTTPS HTTP Strict Transport Security ( HSTS ) HTTP Public Key Pinning ( HPKP ) OCSP stapling Perfect forward secrecy STARTTLS Public - key infrastructure Automated Certificate Management Environment ( ACME ) Certificate authority ( CA ) CA / Browser Forum Certificate policy Certificate revocation list ( CRL ) Domain - validated certificate ( DV ) Extended Validation Certificate ( EV ) Online Certificate Status Protocol ( OCSP ) Public key certificate Public - key cryptography Public key infrastructure ( PKI ) Root certificate Self - signed certificate See also Domain Name System Security Extensions ( DNSSEC ) Internet Protocol Security ( IPsec ) Secure Shell ( SSH ) History Export of cryptography from the United States Server - Gated Cryptography Implementations Bouncy Castle BoringSSL Botan cryptlib GnuTLS JSSE LibreSSL MatrixSSL mbed TLS NSS OpenSSL RSA BSAFE S2n SChannel SSLeay stunnel wolfSSL Notaries Certificate Transparency Convergence HTTPS Everywhere Perspectives Project Vulnerabilities Theory Man - in - the - middle attack Padding oracle attack Cipher Bar mitzvah attack Protocol BEAST BREACH CRIME DROWN Logjam POODLE ( in regards to SSL 3.0 ) Implementation Certificate authority compromise Random number generator attacks FREAK goto fail Heartbleed Lucky Thirteen attack POODLE ( in regards to TLS 1.0 ) Retrieved from `` https://en.wikipedia.org/w/index.php?title=Heartbleed&oldid=846832492 '' Categories : 2014 in computer science Internet security Software bugs Transport Layer Security Hidden categories : Use mdy dates from April 2014 Articles containing potentially dated statements from May 2014 All articles containing potentially dated statements Articles containing potentially dated statements from June 2014 Good articles Pages using RFC magic links Talk Contents About Wikipedia Azərbaycanca বাংলা Bosanski Català Dansk Deutsch Ελληνικά Español Euskara فارسی Français 한국어 Bahasa Indonesia Italiano ქართული Latviešu Lumbaart Magyar മലയാളം Nederlands 日本 語 ଓଡ଼ିଆ Polski Português Română Русский Scots Slovenščina Suomi Svenska தமிழ் Türkçe Українська 中文 26 more Edit links This page was last edited on 21 June 2018, at 04 : 43 ( UTC ). Text is available under the Creative Commons Attribution - ShareAlike License ; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia ® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization. About Wikipedia

Question: first 1.0.1 version of openssl that was not vulnerable to heartbleed
Answer: 1.0.1g