alphaspirit - Fotolia

Heartbleed vulnerability: Why does it persist on so many services?

The Heartbleed flaw still impacts almost 200,000 services connected to the internet. Expert Nick Lewis explains why these services remain unpatched and vulnerable.

Shodan released a report stating that almost 200,000 services connected to the internet remain unpatched against the OpenSSL Heartbleed vulnerability. Most of the impacted services are in the U.S. and running on the Linux 3.x kernel. Nearly three years since the patch was released, how concerning is this data? What do you think is the biggest reason these services are still unpatched?

The internet is sometimes described as a cesspool, and for good reason. Insecure devices seem to survive longer than anyone might expect; it's like someone discovering a pet python in the sewers.

However, finding systems that are still unpatched against the Heartbleed vulnerability three years after its discovery, despite the widespread awareness, is not surprising -- there are still reports about systems being infected with the Conficker worm almost 10 years after it first came out.

It's important to note that the Heartbleed bug is still being found on the internet, but enterprises are not required to take any new actions if they already addressed the Heartbleed vulnerability. Enterprises should also have already required their vendors to provide them with secure products.

The biggest reasons why the Heartbleed vulnerability has endured are the long life of the vulnerable systems and because many of these systems are managed differently from traditional IT systems. Internet service providers could start blocking systems that are participating in Heartbleed attacks, but this could have other unintended consequences that affect legitimate businesses.

Shodan only scans publicly accessible systems, so its report citing 200,000 vulnerable systems is a very conservative estimate. This number could include embedded systems running OpenSSL that weren't patched via normal processes or that never received a manufacturer update.

Next Steps

Find out how CISOs and IT administrators can share patch management responsibilities

Discover how to prevent Rakos malware attacks on embedded Linux systems

Learn about the impact of malware infections of ICS and SCADA systems

Dig Deeper on Network security

Enterprise Desktop
Cloud Computing