Internet users told to change passwords in security alert

INTERNET users have been warned to change all their computer and phone passwords f oll owing what could be a ‘catastrophic’ security breach.

Major technology firms have urged the public to immediately update their online security.

The alert is the result of the discovery of an internet bug called ‘Heartbleed’, which is able to bypass computer security settings.

As a result, personal information such as passwords and credit card details has been accessible.

Heartbleed, so called because it creates a ‘bleeding’ leak of security, is a flaw in OpenSSL, the software used by the majority of websites to keep data secure.

The programme works by encrypting data – such as emails, instant messages, bank details or passwords – making it look like nonsense to hackers.

When a line of communication is secure and information encrypted, the user sees see a padlock on the page. When software is active, one computer may send a ‘heartbeat’ – a small packet of data – to check there is still another computer at the other end.

However, a flaw in the programming meant it was possible to trick the computer at the other end by sending it a packet of data that looked like one of these heartbeats. This made it possible for hackers to impersonate the website and steal the encryption keys, revealing the data being sent.

The bug was found simultaneously by a Google s ecurity researcher and a small Finnish security firm named Codenomicon and disclosed on Monday night.

Many companies have installed a ‘patch’ to fix the flaw, but there are

‘Already harvested’

still many that are vulnerable as service providers must install the update.

Furthermore, it is not known whether hackers had used it before the bug came to light – it went undiscovered for two years – as doing so would not leave a trail.

One of the worst affected sites was Yahoo!, who posted a warning on their blogging site Tumblr to say: ‘ The little lock icon we all trusted to keep our passwords, personal emails, and credit cards safe, was actually making all that private information accessible.’

A spokesman for Codenomicon said: ‘If people have logged into a service during the window of vulnerability then there is a chance that the password i s already harvested.

‘In that sense it’s a good idea to change the passwords on all the updated web portals.’

However, researcher Mark Schloesser said changing a password on websites that have not fixed the bug could reveal ‘both the old and new passwords’ to an attacker.

When contacted by the Mail last night, Britain’s major banks would not comment on whether passwords should be changed.

HSBC said they were ‘monitoring’ the situation and a Lloyds spokesman said they would not comment on security issues.