The discovery of a bug in coding on an estimated 66% of websites has revealed that online data may have been exposed for up to three years.
A test run on 8 April revealed that bank websites including Privatbank’s Russian and Ukranian sites, Barclaycard’s US site and UniCredit’s German subsidiary HypoVereinsbank were vulnerable to the "Heartbleed" bug.
Go deeper with GlobalData
Ari Takanen, chief technology officer at Codenomicon, the Finnish security firm that discovered Heartbleed, said: "If people have logged into a service during the window of vulnerability then there is a chance that the password is already harvested.
"In that sense it’s a good idea to change the passwords on all the updated web portals."
Joe Abbey, director of software engineering at Arxan Technologies, said: "Unlike the Target incident, which required malware on end-point devices (POS terminals), this exploit allows scanning of server memory from any end-user machine on the internet without the requirement to get any malware on to the computer.
"Also, in the Target incident the software exploited was an obscure POS application, whereas this exploit is in code that is open source and has been reviewed by literally thousands of expert eyes for years (showing that a severe exploit can exist right in plain sight)."
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataAmazon was also revealed to be one of the websites using the flawed coding, potentially exposing card details, although the retailer said it had applied ‘mitigations’ to protect users.
The Canadian Revenue Agency (CRA) has suspended its web services, include online tax returns, as a preventative measure.
Considered one of the most serious security flaws uncovered in recent years, it is still unclear if any hackers have taken advantage of Heartbleed.
Non-banking and payment sites affected included Google, Facebook and Yahoo.
All have reported being in the process of fixing the Heartbleed bug threat or having already dealt with it.
Related articles:
Dutch banks warn customers to stop using Windows XP due to fraud risk
Nearly twenty-fold increase in mobile banking Trojans – Kaspersky Labs
Bank of Ireland customers hit by ATM skimming attack
