Heartbleed bug exposes web security flaw

A serious flaw in software used to secure a large part of the internet has been discovered, prompting warnings that passwords and other sensitive information may have been exposed.

The bug, which has been named Heartbleed, was made public on 7 April. It affects OpenSSL, free software used by many websites to encrypt information sent between their servers and users.

What is the problem?

When people visit a secure website, shown by a padlock symbol in their browser, their information is protected by encryption. OpenSSL is one of the most widely used tools for providing that protection.

The flaw is in a feature called the heartbeat, which lets computers check that a connection is still active. By sending a specially crafted message, an attacker could trick a server into sending back up to 64 kilobytes of data from its memory, which might include passwords, private messages or the secret keys used to encrypt traffic.

The flaw leaves no trace, so it is impossible to know whether it has been exploited.

How widespread?

Security experts estimate that around half a million websites may have been vulnerable, including some of the most popular on the internet. The flaw has existed for about two years.

It was discovered independently by a researcher at Google and by engineers at Codenomicon, a Finnish security company, which gave it its name and created a website explaining it.

What should users do?

Website operators are rushing to update their software and replace their security certificates. Many large companies, including Google, Facebook and Yahoo, have said they have fixed the problem.

Experts are advising people to change their passwords, but only once they know that a website has been fixed. Changing a password on a site that is still vulnerable would not help.

In Britain, the parenting website Mumsnet has said some users' data may have been taken, and in Canada the tax authority has temporarily shut its online services.

A wake-up call

The bug has highlighted how much of the internet depends on free software maintained by a small number of volunteers with little funding. OpenSSL is run by a handful of developers, most of whom work on it in their spare time.

Technology companies are now discussing how to provide more support for such projects, which underpin services used by billions of people.