Heartbleed: the flaw in the padlock itself

The story

OpenSSL is free software that many websites, servers and devices use to encrypt connections. In April 2014, researchers announced a flaw in it, which they named Heartbleed.

Encrypted connections send small “heartbeat” messages to check the other side is still there. The other side is supposed to echo back exactly what it received. The bug let someone claim they had sent much more than they had, and the server would reply with extra data from its memory to make up the difference.

That memory could contain anything the server was handling at the time: passwords, private messages, or the secret keys that protect the site’s encryption. Reading it left no trace.

The flaw had been in the software since 2012. A fix was released the same day it was announced. Websites patched quickly, and many asked users to change passwords. Routers, firewalls, phones and other devices with the same software inside took much longer, and some were never fixed.

Why it mattered

Heartbleed showed how much of the internet depended on free software kept up by a handful of people with little funding. Within weeks, the technology industry launched an effort to fund the open-source projects critical infrastructure relies on, paying for full-time developers and security audits.

The lesson today

Much of the internet runs on shared, free software that is maintained by a few people. When a flaw is found in it, it shows up in places you might not think of, including the equipment in your office. Keeping firmware updated on network devices matters as much as updating computers.