Heartbleed panic: Web bug causes security alert

A software bug in a popular open source security program has sparked a frantic rush to secure essential computer servers around the world.

Please join us on our Facebook page http://www.facebook.com/bangkokpostlearning

One of the most visited websites these days is http://heartbleed.com/, set up to help website managers deal with what is potentially a very serious software bug.

'Heartbleed' bug puts encrypted data in danger

SAN FRANCISCO, AFP — Trust in the Internet took a major blow on Tuesday as alarm spread that software commonly used to encrypt and secure online transactions could wind up giving away the store.

Computer security specialists, website masters, and fans of online privacy were worriedly abuzz with word of a freshly-discovered flaw in online data-scrambling software that hackers can turn to their advantage.

A bug dubbed "Heartbleed" in OpenSSL encryption software lets attackers illicitly retrieve passwords and other bits of information from working memory on computer servers, according to cyber-defense specialists at Fox-IT.

"Expect everybody who runs an https web server to be scrambling today," the Tor Project said in a warning posted at its website.

"If you need strong anonymity or privacy on the Internet, you might want to stay away from the Internet entirely for the next few days while things settle," it said.

OpenSSL is used to protect passwords, credit card numbers and other data coursing through the Internet.

Information considered at risk includes source codes, passwords, and "keys" that could be used to impersonate websites or unlock encrypted data.

OpenSSL is used by more than half of websites, but not all versions have the vulnerability, according to heartbleed.com.

The group behind open-source OpenSSL put out a security alert urging users to upgrade to an improved version of the software and gave credit for finding the bug to Neel Mehta of Google Security.

Part of the announcement that appeared on the website of the Canada Revenue Agency (CRA).

While it is not yet known whether hackers have exploited Heartbleed, operators of websites that used the vulnerable version of OpenSSL need to switch to secure versions.

By late Tuesday, software patches and updates were being rushed out.

Meanwhile, some website managers were taking extreme precautions to prevent compromising essential data.

Canada's tax agency shuttered its website Wednesday after warning that encrypted taxpayer data could be vulnerable to the "Heartbleed" bug.

The Canada Revenue Agency (CRA) said the decision, which comes only three weeks before the annual income tax filing deadline, was taken as a "preventative" measure.

สามารถฝึกอ่านออกเสียงและดูคำแปลได้ที่ : http://www.bangkokpost.com/learning/learning-from-news/404519/heartbleed-panic-web-bug-causes-security-alert