On New Year’s Eve in 2011, at one minute before 11pm, a British computer consultant named Stephen Henson finished testing a new version of a popular piece of free security software. With a few keystrokes, he released OpenSSL version 1.0.1 into the public domain. Now, more than two years later, the events of that night have shaken the foundations of the Internet.
OpenSSL is used as the backbone of online security by hundreds of thousands of websites. One of the most popular features it provides is Transport Layer Security (TLS), which scrambles (encrypts) private communications. When you’re checking your bank account or your Web mail and you see that green padlock in your browser’s address bar, you’re using TLS.
This encryption is necessary because without it, hackers and governments could easily intercept and read all the data passed around the Internet. Think of TLS as a system of armoured cars that securely transport your data across the public Internet between secure locations — from you own computer to your bank’s servers, for example.
What Stephen Henson didn’t realise when he released the new version is that he missed a tiny bug in a new feature called Heartbeat. This feature, written by a German graduate student named Robin Seggelmann, had the best of intentions. As we all know, Internet traffic is not 100% reliable. Quite a lot of effort goes into simply checking whether the computer on the other end of the line is still connected and “listening” to what your computer is sending.
Heartbeat makes this process quicker by eliminating the need for lengthy security checks, called renegotiations, every time the connection needs to be tested. It allows one computer to ask the other to repeat a word to test if it is still connected — a bit like the guards in the armoured car saying “copy” at the end of every two-way radio transmission.
Unfortunately, both Seggelmann and Henson missed the fact that this check can be abused to trick the listening computer into replying with up to 64 000 characters of data directly from its memory. The asking computer simply lies about the length of the word it is sending (cat is 64 000 letters long), and the replying computer doesn’t bother to check — it just spits the data out of its memory.
And here’s where it gets really ugly. That data can contain literally anything loaded into memory, including passwords, e-mail addresses and encryption keys. Instead of attacking the armoured car, the hackers now have a secret back door into the warehouse and the codes to the safe.
So, the thousands of online services that use OpenSSL — such as Facebook, Gmail, Yahoo and Pinterest — have potentially become a goldmine for hackers for more than two years. Many cellphones running newer versions of Android are also vulnerable. All of these services are urging users to change their passwords as soon as possible. If you’re not sure, change your password anyway.
The bug, evocatively named Heartbleed, has both the technology community and many ordinary users in uproar. Cries of “How could this be allowed to happen?” and “Someone needs to be held responsible!” are echoing around the Internet.
You might expect OpenSSL to fire Seggelmann and Henson, except that they are volunteers and gave their time to the project for free. The “open” part of its name signals that the software is completely open source — it is created, improved and maintained by a global community of software developers, most of whom work for free. Much of the infrastructure of the Internet, from databases to Web servers, is built on the same model.
This fact has led many people to criticise the entire open-source movement. They decry its “lack of professionalism” and its “buggy code”. But many of the people complaining have happily built enormously profitable businesses on top of OpenSSL without once contributing to the project.
In fact, the OpenSSL Foundation, the organisation responsible for the software, has only five permanent members and less than a dozen major contributors, scattered around the globe. It received a piffling US$2 000 in donations last year, and keeps the lights on by consulting to large corporations and government departments.
The development community has coalesced into two camps — those who feel empathy and forgiveness for the OpenSSL team, and those filled with righteous indignation at what they see as an egregious lapse. But, flawed or not, many will continue using OpenSSL. To rewrite it from scratch, by some estimates, would be a three-year job for a team of 25 developers, with a cost of over $15m.
Regardless of the current panic and finger-pointing, Heartbleed has revealed a fundamental truth about the Internet: some very important parts of its guts rely on goodwill and community spirit. We should not take that for granted. It’s easy to blame, but it’s far more productive to help. — (c) 2014 Mail & Guardian
- Alistair Fairweather is chief technology officer at the Mail & Guardian
- Visit the Mail & Guardian Online, the smart news source