Operations // Identity & Access Management
4/30/2014
11:00 AM
Dave Kearns
Dave Kearns
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

Post-Heartbleed: When Not To Change Your Password

One takeaway from Heartbleed is that conventional wisdom about the need to periodically change passwords is wrong.

Even if you’ve been hiding under a rock or vacationing on Mars you’ve heard about the Heartbleed bug. It wasn’t only prominent in the tech journals and blogs, but was blared forth in the general media. Newspapers, radio, TV, magazines all had screaming headlines urging you to "Change all the passwords!" -- and do it now.

They were, of course, wrong.

Two years ago, when an unencrypted file of usernames and passwords was taken from Yahoo’s website, many of these same general-purpose media outlets were also screaming "Change all the passwords!"

A month before that, when more than 6.5 million hashed user passwords were taken from LinkedIn, the media headlines were (you guessed it): ”Change all the passwords!"

They were mostly wrong in all of these cases.

In the case of LinkedIn, the hashed value of passwords is useful only on that one site -- but without the associated username it’s virtually useless. Still, to correct the problem all that has to happen is for LinkedIn to change the hash factor.

In the case of the Yahoo breach, there were usernames associated with the passwords, and they were in clear text. Speculation was that the file was a backup file acquired by Yahoo along with the purchase of software company Associated Content. Rigorous experimentation showed that none of the username/password combos could be used to login to Yahoo.com. So, no need to change your Yahoo password. If you had the same username/password combo on another site, though, it would be good to change that one.

And that brings us to Heartbleed.
Heartbleed was so named because the vulnerability results from a missing bounds check in the handling of the Transport Layer Security (TLS) Heartbeat extension, within the open-source OpenSSL cryptography library, used by approximately 500,000 secure web servers (close to 20 percent) around the world. These servers were believed to be vulnerable to an attack, which would allow theft of the servers' private keys and users' session cookies and passwords.

Extensive research showed that no attacks had taken place up to the time the patched version of OpenSSL was released. That means no passwords were compromised up to that point. Still, those passwords remained vulnerable until the patch was applied.

But if you changed your password before the patch was applied, then the new password (along with all associated data necessary for the change) was now vulnerable. So, no, you shouldn’t "change all the passwords immediately." But what should you do?

  1. Download the extensions for Chrome and Firefox that check websites’ vulnerability to Heartbleed, which you can find out about in this recent article by Dark Reading’s Kelly Jackson Higgins.
  2. Whenever you use HTTPS to view a website, use the browser tool to see if the site is vulnerable or has been patched (or doesn’t need to be patched).
  3. If it’s vulnerable, Get Out of There -- right away.
  4. If it’s been patched, log in then immediately change your password.

It’s not really difficult, but it does require some discipline on your part. There are many lessons to be learned here, the most important of which is to marshal your information so that you can make an informed decision about security. And never, ever rush off to do something because the blonde newsreader on the local TV news tells you that you have to do it. Seek out information from qualified sources first. I know you do (you’re here at Dark Reading, aren’t you?) but make sure your friends, relatives and co-workers also know.

Conventional wisdom is wrong
The other thing Heartbleed should teach us is that the traditional advice to change passwords periodically is wrong. Consider this: Many conspiracy theorists believe that the NSA was aware of Heartbleed and exploited it for years. That would mean that every time you changed your password on a compromised server the spooks would have another entry for your file. If you were truly conscientious about changing passwords, then the surveillance crew could have 20 or more of your well chosen passwords, which, more than likely, were also used by you at some time or other on secure sites that didn’t use OpenSSL. Changing your password made the NSA’s job easier!

Now, before you get all paranoid, it’s been pointed out that Lavabit, Edward Snowden’s email provider, used the OpenSSL library. If NSA had exploited Heartbleed then they wouldn’t have needed to demand that Lavabit turn over it’s SSL keys. Negative evidence, true, but compelling.

There’s no telling what bugs or exploits will turn up in the future, so rather than urge you to slavishly change passwords every 30-60-90 days, the best advice I can give you is to use different passwords for every site you log into. That way, if anyone is compromised it’s only that one site -- and one account -- that’s vulnerable. 

Dave Kearns is a senior analyst for Kuppinger-Cole, Europe's leading analyst company for identity-focused information security and networking. His columns and books have provided a thorough grounding in the basic philosophies of directory technology, networking, and identity ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/1/2014 | 8:45:33 AM
Re: Change passwords between sites, not over time.
So true, @Dak. When it comes to security, the aphorism  "Don't let the perfect be the enemy of the good" definately applies.
dak3
50%
50%
dak3,
User Rank: Moderator
4/30/2014 | 10:59:08 PM
Re: Change passwords between sites, not over time.
There is no perfect security, unless you disconnect from the 'net
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/30/2014 | 9:10:08 PM
Re: Change passwords between sites, not over time.
Agreed.

And @Marilyn, to expand on my previous statement, after doing more research the vulnerability lies with Apple's touch print as well. However, the person would need a finger print mold such as with other touch print vulnerabilities so this is not specific to the mobile platforms. Though possible, it is a very detailed and therefore difficult attack vector.
red-dot-black-circle
50%
50%
red-dot-black-circle,
User Rank: Apprentice
4/30/2014 | 8:34:53 PM
Re: Change passwords between sites, not over time.
If it comes down to having my password stolen or my thumbprint, I'll give up the password everytime.  Never underestimate the abilities of a truly motivated thief, especially if what you're protecting is truly valuable.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/30/2014 | 6:24:06 PM
Re: Change passwords between sites, not over time.
Also, to the end of a thumb print scanner I would be careful. I have the iPhone 5S and use the thumb print but I hear that there lies a security vulnerability within the Galaxy S5 thumbprint function. I'll have more details soon.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/30/2014 | 3:37:56 PM
Re: Change passwords between sites, not over time.
You can still enter the password manually! I had to figure that out when my husband borrowed my phone. No thumbs involved...
ChrisMurphy
50%
50%
ChrisMurphy,
User Rank: Strategist
4/30/2014 | 3:29:06 PM
Re: Change passwords between sites, not over time.
I would like that. Only problem i can see is I'll often ask my kids to check messages while I'm driving -- I can tell them my password, can't so easily pass them my thumb!  
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/30/2014 | 3:23:22 PM
Re: Change passwords between sites, not over time.
My phone has a thumbprint scanner and I love it! Much better than trying to remember a different password for every site I visit. Three cheers for biometrics.
ChrisMurphy
50%
50%
ChrisMurphy,
User Rank: Strategist
4/30/2014 | 2:55:43 PM
Re: Change passwords between sites, not over time.
My phone has a 7-digit password, and I have to change it every few months. I'm running out of phone numbers to use.
dak3
50%
50%
dak3,
User Rank: Moderator
4/30/2014 | 12:55:55 PM
Re: Change passwords between sites, not over time.
Exactly. Tools like LastPass become very useful.
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, no, no! Have a Unix CRON do the pop-up reminders!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.