UPDATED: Here's the Scoop on the "Heartbleed" Crisis and How It Affects Everyone

UPDATE, 4/12/2014
More info has emerged regarding when the actual "snagging" of data occurred. I'll just mention the new info here instead of trying to rewrite the original post. However, if you still want to know what's happened and why, the post below should explain it (hopefully!).

It turns out that the random snagging in in-memory data started in December 2011, NOT ever since webpages roamed the earth. So the issue only affects websites that use Open SSL between 12/2011 and 4/2014. For the record, OpenSSL didn't really start getting used commercially for website security until 1998, and the heartbleed didn't show up until 2011.

More good news: most financial institutions don't generally use open source technology, probably for obvious reasons, so most banks' sites are OK. BUT, if your password is the same for US Bank as it is for MonsterTruckDerby.com forums, then you could be vulnerable, and should change passwords. If you scroll down to my reply near the bottom, I posted a quote from CNN.com that lists the sites that are safe or who have patched up their world (as of 4/10/2014).

Update,4/12/14: I removed references to changing your usernames and passwords, only passwords need to be changed.

_______________________________________________
Original Post:

Oh boy, here we go again. As the world gets more connected we end up with problems we never thought of 30 years ago... but if you removed it all we'd deflate so it comes with the territory.

FIRST: Here's the summary of what heartbleed is and what you should do. Please note that I never want to create panic such as saying that your PC will detonate if you continue to use XP, etc, but this one is potentially serious.

What It Is
In a nutshell, for 20+ years many but not all "secure" websites are using a security technology that has a now-exposed huge flaw (I'll explain the flaw later in this post if you're interested). When you've been transmitting your username and password and any other sensitive info, even if ordering socks at JC Penney, there could be/may have been/who really knows a time when that data was grabbed by hackers. It's more complicated than that, but in the most basic form, that's the deal. The problem is in a security technology called Open SSL. Not every website in the world uses it but I would guesstimate that 70% of all websites do. When a web designer builds a site they know to use a security technology when needed, and Open SSL is one of them. As programmers we have counted on technologies like that to WORK, and now we see a really bad decision 20 years ago is causing problems. Believe it or not, website that run 100% on Microsoft web products are safe, how's that for a funny? But in reality that's not really the case, see next section.

What You Can Do Right Now for Protection
Change your passwords for every website login you have, ALL of them. Not every website you have visited may be currently vulnerable, but most folks (myself included) use the same email/password for several sites. IF that's been grabbed and IF a hacker can access it and IF they attempt to try yours, they will get into your accounts. However, there are 6 billion people on this earth and the chances of you actually getting targeted are probably as slim as getting hit by lightning, but people do get hit and people do get hacked. It's just safer to sit down and plan out new passwords and never ever use anything you've used before. Do that and you'll be fine. And I think everyone knows that you NEVER use the same password for your banking that you do for a retail site, and if you do, now would be a good time to increase the complexity of your self-created security by having a few planned out passwords for different applications.

So What Is Happening To Cause This?
OK, here's the issue in hopefully laymen terms: when Open SSL was being created for the web so we could have secure transactions, programmers has to deal with the way networks carry data and allow for that list of rules. One standard of how data gets transferred is that it must be in 64KB (64,000 byte) "packets" or chunks of data. Well, most peoples' usernames and passwords are barely 1KB let alone 64KB. So, the programmers had to fill in the rest of the packet with
random data. Think of it like an airplane, imagine if every seat had to be filled or the plane couldn't fly (not an issue these days, lol, flights are always packed). So if a Delta flight wasn't full, they would have to grab random people and stick them in the seats so the plane could move. Weird analogy but that's the concept. So here's what the programmers did: if your login info wasn't a full 64KB of data which it never would be, they would do just that, fill the rest with random useless data that would not get used after the data landed at the server it was heading to, such as adorama.com. So where did they get this random data?? Well, 20 years ago everything from PCs to networks were a LOT slower than today, and the fastest place that data moved in was RAM, the memory in every PC or server, etc. SO, the programmers simply went into the memory of the webserver and grabbed random data floating around. Well, that "random data" is the remains of previous logins by thousands of other website users, and the server just hadn't flushed that data out yet (that's pretty normal, stuff hangs in memory for a while until Windows or whatever other operating system gets around to cleaning it out of memory). I suppose in 1994 this didn't seem that much of an issue, but today we have hundreds of millions of people online everywhere, plus webservers have 100X more memory that 1994, so you can imagine how much login info could be floating around in RAM at any given moment. And then your login info gets sent out on the net padded with other now-used login data that hadn't been flushed yet, and it ain't all that hard to intercept these network packets and store what's in them for future evil use. Today's processors in computers are so fast that algorithms can be written that can sort out this random data and match it up and reconstruct usernames and passwords and bears oh my. Just like taking a paper shredder and given enough time, reconstructing the pages, only this is being done on 2014 PCs with enormous processing power. THAT'S what this heartbleed thing is all about.

I should mention here that username/password info isn't the ONLY data floating in memory that can be grabbed... that data could be anything including encryption keys for all kinds of data flying around the planet. But for us personally the worst part would be account info so that's why I focused on that.

In response to this mess, a patch has been issued to fix the problem by the Open SSL team, whoever that is, but it's going to take a while for all of these places to apply patches and get stuff shored up. However, most major websites that were vulnerable are most likely fixed or being fixed as I write this. Nonetheless, any of us might have had our data snagged out of network packets are is currently churning on someone's computer, so you can see how important it is to get your passwords changed.

This website has been created to explain it as best as possible to the world, if you're interested.

I'm not trying to minimize or condone what's going on here, but in order to enjoy the capability we have, this type of stuff is going to emerge and so we just need to stay on top of things. 120 years ago there were no such thing as automobile accidents but we probably don't want to give up our cars now, lol. Although if I could afford it, and all electric Tesla S would work for me and there would be no fossil fuel pollution emitting.

DISCLAIMER: This whole thing is still developing and the perceived danger level WILL change as the reporting of this whole mess continues... and also, I'm only one guy who knows SOME of this stuff so I may not be completely accurate in my assessment, there could be new news even tomorrow that changes the dynamics of all of this. SO, if others in the industry have a closer view of what's happening with this Heartbleed thing, please speak up. In the end, changing passwords never hurts, it's something we should all probably do a couple times a year, as annoying as that sounds. Thanks!

Paul, thanks for the informative post!

Thanx for the all this valuable info Paul.
I feel so much better now
I found great solace in the getting struck by lighting part

Does this mean I need to change the email name that I have used for years? If I never buy anything on line do I still need to change my user names and passwords? Does this apply for websites that I just look at and read but don't do any commercial transcations with and haven't given any credit card account or bank account info to? For instance I frequently log on to the Audubon Dallas website Bird Talk forum. All I do is post comments and photos but no financial info. Do I need to change that password and username? Do I need to change my NPN username and password?

Thanks for your help and posts on this situation.

Robert,

You should not need to change your e-mail or user name on sites you visit. You should change your password to a strong one, and use a different password for each site. In fact, you should not change your user name, or your email if its your user name, because that is how you are identified in the site's database.

I encourage everyone to use a service such as Last Pass to store your info on your machine. Last Pass can also generate strong passwords for you.

--P

Preston's right, you really only need to change your passwords. Sometimes I go overboard with "the fix", lol.

If you use the same password for any account that handles financial or personal info AND is used for forums, etc, those passwords should be changed.

Here's an excerpt from a CNN article that shows specific websites that are safe:

Change these passwords now (they were patched)
Airbnb Google, YouTube and Gmail Facebook Yahoo, Yahoo Mail, Tumblr, Flickr OKCupid Pinterest Wikipedia

Don’t worry about these (they don’t use the affected software, or ran a different version)
Amazon Apple, iCloud and iTunes AOL and Mapquest Bank of America BECU Capital One bank Charles Schwab Chase bank Citibank E*Trade Fidelity Healthcare.gov (Health Department said “security protections prevent this vulnerability from occurring.”) HSBC bank Hulu LinkedIn Microsoft, Hotmail and Outlook PayPal PNC bank Scottrade TD Ameritrade Twitter U.S. Bank Vanguard Wells Fargo

Don’t change these passwords yet (still unclear, no response)
American Express

UPDATE, 4/12/2014: Here's a VERY comprehensive list of sites and their safety status.

I found great solace in the getting struck by lighting part

Yeah Howard, I probably could have worded that better...

Thank you for answering my question Paul and Preston.