A little backstory
Back in 2014, HTTPS became a hot-topic after the Heartbleed bug became public. This bug allows people with ill intent to listen in on traffic being transferred over SSL/TLS. Therefore, it gave them the ability to hijack and/or read the data. Luckily, researchers patched this bug quickly after its discovery. This incident was a wake-up call that properly encrypting user information over the internet is a necessity.
To emphasize the importance of encrypting sensitive data, Google Chrome (since January 2017) displays a clear warning next to the address bar whenever you visit a website that doesn’t encrypt – potential – sensitive data, such as forms.
The Heartbleed bug – an https incident!
The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).
The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. Consequently, this compromises the secret keys used to identify the service providers and to encrypt the traffic, the names, and passwords of the users and the actual content. As a result, this allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
What leaks in practice?
We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able to steal from ourselves the secret keys used for our X.509 certificates, usernames and passwords, instant messages, emails and business critical documents and communication.
How to stop the leak?
As long as the vulnerable version of OpenSSL is in use, attackers can abuse it. Fixed OpenSSL has been released and now everyone can deploy it. Therefore, operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the software they use.
But all these are history.
HTTPS is strong enough to protect all our transactions.