(Press-News.org) A detailed analysis by cybersecurity experts from the University of Maryland found that website administrators nationwide tasked with patching security holes exploited by the Heartbleed bug may not have done enough.
First disclosed in April 2014, Heartbleed presents a serious vulnerability to the popular OpenSSL (Secure Sockets Layer) software, allowing anyone on the Internet to read the memory of systems that are compromised by the malicious bug.
Assistant Research Scientist Dave Levin and Assistant Professor of Electrical and Computer Engineering Tudor Dumitras were part of a team that analyzed the most popular websites in the United States--more than one million sites were examined--to better understand the extent to which systems administrators followed specific protocols to fix the problem.
Levin and Dumitras both have appointments in the Maryland Cybersecurity Center, one of 16 centers and labs in the University of Maryland Institute for Advanced Computer Studies.
Their team, which included researchers from Northeastern University and Stanford University, discovered that while approximately 93 percent of the websites analyzed had patched their software correctly within three weeks of Heartbleed being announced, only 13 percent followed up with other security measures needed to make the systems completely secure.
Once Heartbleed was made public, Levin says, website administrators everywhere should have immediately taken three steps to regain better control and security over their systems.
"They needed to patch their OpenSSL software, they needed to revoke their current certificates, and they needed to reissue new ones," he says.
Patching, revoking and reissuing are elements of the PKI, or Public Key Infrastructure, which allows for browsers and operating systems to verify that they are communicating with an authentic website, rather than an attacker who is masquerading as a website in order to gain sensitive user information.
But without following through with both revocation and reissue, attackers who already had a website's private key could still pose as that website, even if the administrator had correctly patched their software.
"Many people seem to think that if they reissue a certificate, it fixes the problem, but, actually, the attack remains possible just as it did before. So, you need to both reissue and revoke the certificates," says Dumitras.
The team's data analysis also highlighted an interesting trend that points to the role that humans play in these complex security systems, Dumitras says. In a graph displaying how many certifications were revoked over the course of the three weeks, their data shows a significant drop in revocation rates during weekends.
"Basically, that means that security was taking the weekends off," he says.
Dumitras and Levin hope that the team's findings--presented this week at the 2014 Internet Measurement Conference in Vancouver, B.C.--will spur conversations regarding the multiple factors that influence overall computer security, and how those factors can work together to better strengthen systems.
"Security isn't something to be taken for granted," Levin says. "I see some of these results and I'm shocked and I'm surprised and I'm a little bit scared. But at the same time, I see it as opportunity for improvement."
INFORMATION:
Paper link: http://www.umiacs.umd.edu/~tdumitra/papers/IMC-2014.pdf
Team research page: http://www.securepki.org
Written by Andrew Snadecki '14
University of Maryland
College of Computer, Mathematical, and Natural Sciences
2300 Symons Hall, College Park, Md. 20742
http://www.cmns.umd.edu
@UMDscience
About the College of Computer, Mathematical, and Natural Sciences
The College of Computer, Mathematical, and Natural Sciences at the University of Maryland educates more than 7,000 future scientific leaders in its undergraduate and graduate programs each year. The college's 10 departments and more than a dozen interdisciplinary research centers foster scientific discovery with annual sponsored research funding exceeding $150 million.
Cybersecurity experts discover lapses in Heartbleed bug fix
2014-11-07
ELSE PRESS RELEASES FROM THIS DATE:
Researchers take new approach to stop 'Most Wanted' cancer protein
2014-11-07
BOSTON (November 7, 2014) -- Researchers at Dana-Farber/Boston Children's Cancer and Blood Disorders Center have found a way to defeat one of the most tantalizing yet elusive target proteins in cancer cells - employing a strategy that turns the protein's own molecular machinations against it.
In a study published online by the journal Cell, the scientists used a specially crafted compound to disrupt the protein's ability to rev up its own production and that of other proteins involved in tumor cell growth. The result, in laboratory samples of neuroblastoma cancer cells ...
NASA eyes Post-Tropical Storm Nuri's winds, now to affect Alaska
2014-11-07
NASA's newest Earth observing mission, the International Space Station-Rapid Scatterometer, or ISS-RapidScat provided a look at the winds within post-tropical cyclone Nuri on Nov. 5 and 6 as it moved parallel to Japan. Nuri has moved across the Pacific and is expected to bring hurricane-force wind gusts to Alaska's Aleutian Islands today, Nov. 7.
"RapidScat passed over Nuri, near Japan, three times within a 24 hour period," said Doug Tyler of NASA's Jet Propulsion Laboratory, Pasadena, California. "The progression [in three images] showed Nuri's path."
RapidScat measured ...
Workplace health programs are key to improving american life expectancy and health
2014-11-07
New York - As Americans face growing health and financial burdens from preventable, non-communicable diseases such as cardiovascular disease, diabetes and certain cancers, a new study demonstrates employers have a unique opportunity to improve Americans' health. The research is led by Dr. Katherine Tryon and Dr. Derek Yach from the Vitality Institute and is published in the November issue of the Journal of Occupational and Environmental Medicine.
The study, which involved a first-of-its-kind comprehensive review of existing research into workplace health programs, notes ...
A vaccine directed against tumor blood vessels suppress tumor growth and metastasis
2014-11-07
In a new study published in the scientific journal Oncotarget researchers from Uppsala University show that a therapeutic vaccine directed against tumor vessels can reduce tumor burden and suppress formation of spontaneous lung metastases in a mouse model for metastatic breast cancer.
The target molecule of the immunization strategy is the extra domain-A (ED-A) of fibronectin, a protein domain which is highly selective for the tumor vasculature in the adult.
"The vaccination approach we have employed is not prophylactic but therapeutic, meaning that immunity was induced ...
NASA-NOAA's Suomi NPP satellite sees Tropical Cyclone 05B headed to India
2014-11-07
Tropical Cyclone 05B was meandering in the Bay of Bengal on Nov. 8, but forecasters expect it to move west and head toward east-central India for landfall. NASA-NOAA's Suomi NPP satellite captured a visible image of the tropical storm off India's coast.
When Suomi NPP flew over Tropical Cyclone 05B (TC05B) on Nov. 7 at 08:09 UTC (3:09 a.m. EST), the Visible Infrared Imaging Radiometer Suite or VIIRS instrument aboard captured a visible image of the storm. The VIIRS image showed a band of thunderstorms wrapping into the center from the northern quadrant, and fragmented ...
Actions versus objects: The role of the motor system
2014-11-07
Amyotrophic lateral sclerosis (ALS) is a very severe disease that mainly affects the motor system. Recently the focus of public attention thanks to a viral campaign (remember last summer's ALS Ice Bucket Challenge?), ALS leads to progressive paralysis and ultimately death. Among the lesser known symptoms of the disease are cognitive impairments, which may even involve full-blown dementia. One of them is a selective difficulty in understanding and using verbs denoting actions, which these patients find much more challenging to process compared to nouns denoting objects. ...
The best sensory experience for learning a dance sequence
2014-11-07
This news release is available in German.
How can a sequence of dance steps best be learned? This question was the subject of a project led by researchers from Bielefeld University and the Palucca University of Dance in Dresden, who developed the study along with dancers and dance instructors. Together they researched whether dancers learn a dance sequence better by seeing or by listening, that is, if a dance instructor first demonstrates the sequence, or if he or she first gives a spoken explanation. The research article detailing the results of this study was recently ...
Origin of the unique ventilatory apparatus of turtles
2014-11-07
Through the careful study of modern and early fossil tortoise, researchers now have a better understanding of how tortoises breathe and the evolutionary processes that helped shape their unique breathing apparatus and tortoise shell. The findings published in a paper, titled: Origin of the unique ventilatory apparatus of turtles, in the scientific journal, Nature Communications, on Friday, 7 November 2014, help determine when and how the unique breathing apparatus of tortoises evolved.
Lead author Dr Tyler Lyson of Wits University's Evolutionary Studies Institute, the ...
Brain's response to threat silenced when we are reminded of being loved and cared for
2014-11-07
Being shown pictures of others being loved and cared for reduces the brain's response to threat, new research from the University of Exeter has found.
The study discovered that when individuals are briefly presented pictures of others receiving emotional support and affection, the brain's threat monitor, the amygdala, subsequently does not respond to images showing threatening facial expressions or words. This occurred even if the person was not paying attention to the content of the first pictures.
Forty-two healthy individuals participated in the study, in which ...
Maybe it wasn't the Higgs particle after all
2014-11-07
Last year CERN announced the finding of a new elementary particle, the Higgs particle. But maybe it wasn't the Higgs particle, maybe it just looks like it. And maybe it is not alone.
Many calculations indicate that the particle discovered last year in the CERN particle accelerator was indeed the famous Higgs particle. Physicists agree that the CERN experiments did find a new particle that had never been seen before, but according to an international research team, there is no conclusive evidence that the particle was indeed the Higgs particle.
The research team has ...