Heartbleed: diferenças entre revisões

Heartbleed é um bug na biblioteca do software de criptografia open-source [[OpenSSL], que permite a um atacante ler a memória de um servidor ou de um cliente, permitindo a este recuperar chaves SSL privadas do servidor. <ref name="NYT-20140409">{{cite news |last=Chen |first=Brian X. |title=Q. and A. on Heartbleed: A Flaw Missed by the Masses |url=http://bits.blogs.nytimes.com/2014/04/09/qa-on-heartbleed-a-flaw-missed-by-the-masses/ |date=April 9, 2014 |work=[[New York Times]] |accessdate=April 10, 2014 }}</ref><ref name="NYT-20140410a">{{cite news |last=Wood |first=Molly |title=Flaw Calls for Altering Passwords, Experts Say |url=http://www.nytimes.com/2014/04/10/technology/flaw-calls-for-altering-passwords-experts-say.html |date=April 10, 2014 |work=[[New York Times]] |accessdate=April 10, 2014 }}</ref><ref name="NYT20140410">{{cite news |last=Manjoo |first=Farhad |title=Users’ Stark Reminder: As Web Grows, It Grows Less Secure |url=http://www.nytimes.com/2014/04/10/technology/users-stark-reminder-as-web-grows-it-grows-less-secure.html |date=April 10, 2014 |work=[[New York Times]] |accessdate=April 10, 2014 }}</ref> Os logs que foram examinados até agora, levam a crer que alguns hacker podem ter explorado a falha de segurança há pelo menos cinco meses antes da falha ser descoberta pelas equipes de segurança. <ref>{{cite web |first=Sean |last=Gallagher |title=Heartbleed vulnerability may have been exploited months before patch |url=http://arstechnica.com/security/2014/04/heartbleed-vulnerability-may-have-been-exploited-months-before-patch/ |work=[[Ars Technica]] |date=April 9, 2014 |accessdate=April 10, 2014}}</ref><ref>[http://blog.erratasec.com/2014/04/no-we-werent-scanning-for-hearbleed.html#.U0Z5kfmSxMi "No, we weren't scanning for hearbleed before April 7"]</ref><ref>[https://www.eff.org/deeplinks/2014/04/wild-heart-were-intelligence-agencies-using-heartbleed-november-2013 "Were Intelligence Agencies Using Heartbleed in November 2013?"], April 10, 2014, Peter Eckersley, EFF.org</ref>