Heartbleed bug not a failure of tech security

2014-04-16 14:29
Government departments and agencies should not be granted exceptional exemptions to the provisions of Popi legislation, a security firm says. (Duncan Alfreds, News24, file)

Government departments and agencies should not be granted exceptional exemptions to the provisions of Popi legislation, a security firm says. (Duncan Alfreds, News24, file)

Multimedia   ·   User Galleries   ·   News in Pictures Send us your pictures  ·  Send us your stories


Cape Town - The Heartbleed bug does not represent a failure in the technology behind security, rather it indicates that there was a lack of implementation, a security expert has said.

Computer security professionals have been in panic over the bug which can be exploited to steal encrypted information such financial data.

"Heartbleed does not represent a failure in math behind the security. In fact, it was an implementation flaw in a part of code that had nothing to do with encryption," John Miller, Trustwave Security Research manager told News24.

The bug exploits a vulnerability in OpenSSL which is used to transmit encrypted data. Typically, access to a secure website is provided by typing in "https", but the bug allows hackers to steal data transmitted through secure channels.

"Heartbleed will stand as a reminder that security is hard and that even simple bugs can have wide ranging and unexpected consequences," said Miller.

Detection systems

In 2013, reports emerged that banks lost millions to an international card fraud syndicate.

The scam hit businesses that make use of the point of sales terminals and the Dexter malware as it is known, was used to gather customer information and sold to other criminals.

"Unfortunately, as much as we'd all like to see perfection, we're stuck in an imperfect world and must deal with such events when they occur. An organisation's response to these severe events can serve as a metric of their trustworthiness," Miller warned.

He said that automated system controls serve to slow a criminal attacking a network, but without a response, these controls don't provide much of a defence.

"Automated security controls serve to slow an attacker, detect and alert when an attack is occurring, and allow a system defender to respond. Without all three of those components, security controls don't end up providing all that much security."

Heartbleed attacks can slip through detection systems because the bug leaves no trace and only allows small bits of information to be compromised at a time.

"With a compromised SSL key, an attacker is able to impersonate the affected server nearly undetectably. Human behaviour comes into play when we consider how users establish trust in other systems," Miller said, adding that people could be duped into trusting a malicious system.

"For SSL, users rely on a chain of trust going from their software to a set of root certificate authorities. Any failure in that chain can result in users incorrectly trusting a malicious system."

 - Follow Duncan on Twitter
- News24
Read more on:    trustwave  |  cybercrime

Read News24’s Comments Policy

24.com publishes all comments posted on articles provided that they adhere to our Comments Policy. Should you wish to report a comment for editorial review, please do so by clicking the 'Report Comment' button to the right of each comment.

Comment on this story
Add your comment
Comment 0 characters remaining

Inside News24


The truth about painkillers and exercise

Many of us use painkillers and anti-inflammatory medicines to mask pain so they can continue with their training.


Where were you when you last felt alive?

This all-terrain vehicle is badass!
Where were you when you last felt alive?
Watch: Fishing under ice
This is why you need to get fit in your 20's

Jobs in Cape Town [change area]

Property [change area]

Travel - Look, Book, Go!

Magical Massinga

Spend 5 nights at the gorgeous Massinga Beach Lodge in Mozambique and only pay for 4 from R13 220 per person sharing. Includes return flights, accommodation, transfers and romantic turndown. Book now!

Kalahari.com - shop online today

Deal of the week!

Save R1200 on the Samsung 48” smart full HD LED television now only R8799. Buy now!

Toys 4 for the price of 3

Buy 4 toys and get the cheapest FREE! Offer valid while stocks last. Shop now!

Mind blowing prices – As seen on TV

Get mind blowing prices on 1000’s of products! Shop now.

Save 20% on Nivea beauty products!

Buy any two Nivea beauty products and save 20%. Offer valid while stocks last. Shop now!

Save up to R1000 on electronics!

Get mind blowing savings on top electronic products. Shop now.

OLX Free Classifieds [change area]

Samsung Galaxy s4

Mobile, Cell Phones in South Africa, Western Cape, Cape Town. Date October 24

Best bargain in big bay

Real Estate, Houses - Apartments for Sale in South Africa, Western Cape, Cape Town. Date October 25

VW Golf 6, 1.6 Trendline (Excellent condition)

Vehicles, Cars in South Africa, Western Cape, Cape Town. Date October 25


You may be spending too much time organising and trying to control things to make sure everything is perfect instead of just...read more

There are new stories on the homepage. Click here to see them.


Create Profile

Creating your profile will enable you to submit photos and stories to get published on News24.

Please provide a username for your profile page:

This username must be unique, cannot be edited and will be used in the URL to your profile page across the entire 24.com network.


Location Settings

News24 allows you to edit the display of certain components based on a location. If you wish to personalise the page based on your preferences, please select a location for each component and click "Submit" in order for the changes to take affect.

Facebook Sign-In

Hi News addict,

Join the News24 Community to be involved in breaking the news.

Log in with Facebook to comment and personalise news, weather and listings.