How the Heartbleed bug reveals a flaw in online security

By Robert Merkel

Photo / Thinkstock
Photo / Thinkstock


The bug is in an extremely widespread piece of software called OpenSSL. OpenSSL allows programmers to write systems that send sensitive data such as financial or medical information over the internet, with confidence that anybody "listening in" will only get indecipherable gibberish.

Read more:
Heartbleed bug: What you need to know
'Heartbleed' online security flaw exposes millions of passwords

It also provides a way to prove that a message came from a particular organisation's computer, so that you can be confident you're sending your credit card details to Amazon or Apple rather than a criminal.

How was OpenSSL developed?



It is made available as open source software for anyone to use for free on very liberal terms. Most of the world's internet servers - and every Android smartphone - use a great deal of software developed in this manner, though many such developer teams include paid professionals from companies who use the software.

The Heartbleed bug

On New Year's Eve 2011, German researcher and OpenSSL contributor Robin Seggelmann added code implementing a new feature called "heartbeats".

The idea was straightforward: if a connection between two computers stays silent for too long, it is disconnected, so periodic "heartbeat" messages can keep the connection going.

As well as a simple "I'm here", messages contain a arbitrary "payload" which is sent back and forth, a little like this:

Computer 1: "Hi, I'm still here, the payload is 5 characters long and is '12345'."

Computer 2: "Hi, great, you're still there, and your payload was 5 characters long and was '12345'."

Unfortunately, Seggelmann's code didn't check that the payload was of the indicated length, so a malicious request could request more data than was in the payload:

Computer 1: "Hi, I'm still here, the payload is 50,000 characters long and is '12345'."

Computer 2 would then send back a message with a payload of the requested length, the first characters of which would be the 12345 sent. The rest would be whatever happened to be in the computer's memory next to the payload.


With access to this key, an "attacker" can electronically impersonate the organisation who rightfully owns the key, and unscramble all the private messages sent to that organisation - including old ones, if they've kept the previously unreadable scrambled versions.

Criminals could, for instance, steal the key of a major bank and then electronically impersonate it. It's a potential field day for spies, too.

Discovery and consequences

The buggy code was incorporated into a June 2012 release of OpenSSL that was widely adopted, and there it stayed until discovered virtually simultaneously by Google's security team, and Codenomicon, an internet security company.




System administrators across the world have been furiously installing the fix on millions of computers. They're also scrambling to generate new master keys.




Even if there hasn't been any malicious exploitation of the bug, the costs of people's time will likely run into the hundreds of millions of dollars.

A tiny mistake but a major headache




  1. • Use technical measures, such as alternative programming languages, that make this type of error less likely

  2. • Tighten up the process for making changes to OpenSSL, so that they are subject to much more extensive expert scrutiny before incorporation.


It's hard to be too critical of those of who volunteer to build such a useful tool but OpenSSL's design prioritises performance over security, which probably no longer makes sense.




They didn't do either, so they - and now we - wear the consequences, which likely far exceed the costs of mitigation.

And while you shake your head at the IT geeks, I leave you with a question - how are you identifying and managing the risks that your own organisation faces?The Conversation

Robert Merkel has received funding from the Australian Research Council.This article was originally published on The Conversation.

Read the original article.

© Copyright 2014, APN New Zealand Limited

Assembled by: (static) on production apcf02 at 29 Dec 2014 06:28:26 Processing Time: 212ms