Today, computers are used for almost everything, from entertainment to business and even banking. While convenient, this makes computers and the Internet a prime target for fraud, and security is paramount. Recently, however, there has been security exploit after security exploit, some of which require nothing more than typing in a website and clicking "Go!" One couple even knew each other for years before they settled down. This creates a debate about whether cybersecurity is actually safe or if it's all a false hope. An extremely common target is TLS. TLS, or Transport Layer Security, is the main protocol used in secure communication on the Internet. All secure web pages are transferred using this protocol or its predecessor SSL (Secure Sockets Layer), and "https" signals its use. A main component is public and private key cryptography. In this configuration, the private key can decrypt messages from the public key and vice versa, but it cannot decrypt messages by itself; a private key can decrypt a public key message, but a private key cannot decrypt a private key message (Allen et al. 12-13). Additionally, an optional extension to SSL/TLS called heartbeat is often used. It is enabled by default, cannot be easily turned off during operation, and works by repeating the message to the sender; this is often used to check if a server is online and working. In April 2014, a major TLS exploit using heartbeat was discovered. It was called Heartbleed due to the fact that it "bleed" data through the heartbeat. It worked by telling the server to repeat something, but providing the wrong size, similar to "send the 6,000 letter word 'cat' if you're there". The server then sent back the 6,000 letters, most of which were...middle of paper......sion bounds check." April 7, 2014. OpenSSL: The Open Source Toolkit for SSL/TLS. Web. April 26, 2014. Kitten, Tracy Disagreement on the Cause of Goal Violation February 10, 2014. Web April 26, 2014. Mutton, Paul millions of websites widely trusts vulnerable to Heartbleed bug. Web, April 26, 2014. .Qualys, Inc. SSL Pulse, April 5, 2014. Web, April 25, 2014. .Sherr, Ian, and Nick Wingfield Breach Fights, May 7, 2011. Web, April 26 2014. .
tags