Heartbleed bug not a failure of tech security

2014-04-16 14:29
Government departments and agencies should not be granted exceptional exemptions to the provisions of Popi legislation, a security firm says. (Duncan Alfreds, News24, file)

Government departments and agencies should not be granted exceptional exemptions to the provisions of Popi legislation, a security firm says. (Duncan Alfreds, News24, file)

Multimedia   ·   User Galleries   ·   News in Pictures Send us your pictures  ·  Send us your stories

Cape Town - The Heartbleed bug does not represent a failure in the technology behind security, rather it indicates that there was a lack of implementation, a security expert has said.

Computer security professionals have been in panic over the bug which can be exploited to steal encrypted information such financial data.

"Heartbleed does not represent a failure in math behind the security. In fact, it was an implementation flaw in a part of code that had nothing to do with encryption," John Miller, Trustwave Security Research manager told News24.

The bug exploits a vulnerability in OpenSSL which is used to transmit encrypted data. Typically, access to a secure website is provided by typing in "https", but the bug allows hackers to steal data transmitted through secure channels.

"Heartbleed will stand as a reminder that security is hard and that even simple bugs can have wide ranging and unexpected consequences," said Miller.

Detection systems

In 2013, reports emerged that banks lost millions to an international card fraud syndicate.

The scam hit businesses that make use of the point of sales terminals and the Dexter malware as it is known, was used to gather customer information and sold to other criminals.

"Unfortunately, as much as we'd all like to see perfection, we're stuck in an imperfect world and must deal with such events when they occur. An organisation's response to these severe events can serve as a metric of their trustworthiness," Miller warned.

He said that automated system controls serve to slow a criminal attacking a network, but without a response, these controls don't provide much of a defence.

"Automated security controls serve to slow an attacker, detect and alert when an attack is occurring, and allow a system defender to respond. Without all three of those components, security controls don't end up providing all that much security."

Heartbleed attacks can slip through detection systems because the bug leaves no trace and only allows small bits of information to be compromised at a time.

"With a compromised SSL key, an attacker is able to impersonate the affected server nearly undetectably. Human behaviour comes into play when we consider how users establish trust in other systems," Miller said, adding that people could be duped into trusting a malicious system.

"For SSL, users rely on a chain of trust going from their software to a set of root certificate authorities. Any failure in that chain can result in users incorrectly trusting a malicious system."


 - Follow Duncan on Twitter
- News24
Read more on:    trustwave  |  cybercrime
NEXT ON NEWS24X
SHARE:

Read News24’s Comments Policy

24.com publishes all comments posted on articles provided that they adhere to our Comments Policy. Should you wish to report a comment for editorial review, please do so by clicking the 'Report Comment' button to the right of each comment.

Comment on this story
0 comments
Add your comment
Comment 0 characters remaining
 

Inside News24

 
/News
 

Sexiest Instagrams of 2014

Check out some of the sexiest celebrity Instagrams of 2014!

 
 

I love summer.24

Joburg hot spots for cocktails, craft beer, tapas and wine!
Summer Survey!
Great ideas for the best summer sandwiches!
Christmas lingerie to make this festive season the best one ever!

Jobs in Cape Town [change area]

Property [change area]

Travel - Look, Book, Go!

Kalahari.com - shop online today

2DAYS ONLY – 30% off Appliances

Coffee makers, blenders, fans, juicers and more. T&Cs apply. Shop now!

2 DAYS ONLY – 40% off books

Get 40% off when you buy 2 books. For two days only! T&Cs apply. Buy now!

Up to 50% off on outdoor gear

Save on chairs, blankets, cooler bags, umbrellas and more. Shop now!

Save on Samsung

Cameras, mobile phones, TVs, Tablets and more. While stocks last. Shop now!

Grand Theft Auto 5

Now available on PS4, Xbox One and PC from R649. Buy now!

OLX Free Classifieds [change area]

Samsung Galaxy s4

Mobile, Cell Phones in South Africa, Western Cape, Cape Town. Date October 24

Best bargain in big bay

Real Estate, Houses - Apartments for Sale in South Africa, Western Cape, Cape Town. Date October 25

VW Golf 6, 1.6 Trendline (Excellent condition)

Vehicles, Cars in South Africa, Western Cape, Cape Town. Date October 25

Horoscopes
Aquarius
Aquarius

The energy today is serious, materialistic and hardworking. You may find you get a new outlook on things and you may want to spend...read more

There are new stories on the homepage. Click here to see them.
 
English
Afrikaans
isiZulu

Hello 

Create Profile

Creating your profile will enable you to submit photos and stories to get published on News24.


Please provide a username for your profile page:

This username must be unique, cannot be edited and will be used in the URL to your profile page across the entire 24.com network.

Settings

Location Settings

News24 allows you to edit the display of certain components based on a location. If you wish to personalise the page based on your preferences, please select a location for each component and click "Submit" in order for the changes to take affect.








Facebook Sign-In

Hi News addict,

Join the News24 Community to be involved in breaking the news.

Log in with Facebook to comment and personalise news, weather and listings.