Pelican Parts Forums - "Heartbug" virus question:

Pelican Parts Forums (http://forums.pelicanparts.com/)

- Off Topic Discussions (http://forums.pelicanparts.com/off-topic-discussions/)

- - "Heartbug" virus question: (http://forums.pelicanparts.com/off-topic-discussions/805540-heartbug-virus-question.html)

"Heartbug" virus question:

Do I now have to change my PW on every site that has the padlock icon on address bar, like ebay/paypal, etc...?

Is it too late? Did the boogeyman in Russia, or wherever, already steal all my info? :)

Enquiring minds want to know.

No only some sites are affected. OpenSSL sites, it's been in the wild a long time so they would have got what they needed by now

No point in changing your password until you have confirmed that the site has "fixed the glitch". If the site hasn't updated to mitigate the bug, and you change your password, then you are potentially just giving them your new password.

If you are concerned about the sites you visit, Qualsys has updated their SSL test to check for Heartbleed vulns.

https://www.ssllabs.com/ssltest/index.html

There's supposedly a civilian version of Stuxnet virus which can jump air gaps:
BadBios Virus: 5 Fast Facts You Need to Know | HEAVY
The “BadBIOS” virus that jumps airgaps and takes over your firmware – what’s the story? | Naked Security

Ultimate power corrupts, ultimately.

Quote:

Originally Posted by Paul_Heery (Post 8007349)

If you are concerned about the sites you visit, Qualsys has updated their SSL test to check for Heartbleed vulns.

https://www.ssllabs.com/ssltest/index.html

Love those guys. Excellent link - thanks for that.

Basically if a site is using this version of OpenSSL for their encryption then someone can listen for the traffic, copy it, decrypt it and your username and password for that password might be in it.

If it is, well you could have given access to your bank to someone.

This is why two-factor authentication is so important for things that matter. If you had a regular password and then a one time password from somewhere else then getting the one password would not compromise you. The one time password you also have changes every time and you have some 'thing' either an app on your computer/smart device or a fob that creates the one time password. They would get that password which isn't good for more than one login.

Anyway.

I hate it when encryption bugs happen.

C|NET's list of top 100 sites that have been patched...

...along with those that haven't... and those that supposedly were never vulnerable:

Heartbleed bug: Check which sites have been patched - CNET