US CERT says the Heartbleed flaw is under attack

With the recently revealed ‘Heartbleed’ security bug potentially leading to phishing and cyber-crime attacks, industry experts are still advising internet users to change passwords.

Now, the American Government has admitted that attacks have occurred that are able to exploit Heartbleed, which has affected hundreds of thousands of websites as well as a number of global systems.

ICS-CERT, which belongs to the US Department of Homeland Security (DHS), has warned about Heartbleed, revealing that it has knowledge of instances in which the vulnerability has been exploited.

It said that it has been keeping a close eye on the situation, and that anyone noticing any incidents regarding the flaw has been advised to report them to the DHS.

Security vendor Easy Solutions confirmed the cyber attacks report and said that more than 10,000 websites with the bug have come under attack by hackers.

Daniel Ingevaldson, CTO of Easy Solutions, said in a blog post on 10th April:

“Hackers are posting huge lists of 10,000-plus domains that have been run through the automated web-based Heartbleed vulnerability checking tools. This list described if the web sites are vulnerable, patched, or if SSL was not present.”

There has been much talk about Heartbleed in risk and network forums on the web lately, and it has made a number of organisations sit up and take notice of the potential for cyber attacks and how their customers’ data is possibly at risk. Governments and even security vendors have an increased responsibility to make both businesses and consumers aware of any similar threats should they arise in the future.