The Heartbleed bug - what do you need to do?

This week the web was rocked by a security bug nicknamed Heartbleed. In short, it’s a flaw in a commonly used security system that potentially two-thirds of websites use to keep information like usernames and passwords secure.

The flaw was discovered by security researchers in Finland in the last couple of weeks. By now, most sites that were vulnerable to the flaw have patched it.

There have been no confirmed instances of hackers or cybercriminals using this flaw to steal information. But that doesn't necessarily mean it hasn't happened, and the fact that the flaw dates all the way back to December 2011 means that personal information may have been compromised.

Here's a guide to which other sites have and have not been affected, and what exactly you should do about changing your passwords. This is not an exhaustive list.

Tthere are sites which are capable of checking whether a particular website is still vulnerable to Heartbleed. However, in an unpredictable and unhelpful twist, it has been pointed out (here) that doing so may in fact be illegal under the Computer Misuse Act.

But there is some good news: The login information for your online banking is almost certainly safe. Halifax, RBS, HSBC, Natwest, Lloyds, Barclays, Santander and Co-op have all confirmed that their systems were unaffected.

If in doubt, it is always a good idea to regularly change your online passwords. If a site has reported that it was vulnerable to Heartbleed, you should change your password but only if you are sure that they have since fixed the problem. If they have not, you may be at greater risk by changing.

Email providers
Here are the ones that were vulnerable:

• Yahoo Mail: It was affected. But now it has been patched. Yahoo Mail was vulnerable to attack but has since announced that it has been patched, along with other main Yahoo sites such as Yahoo Search, Finance, Sports, Flickr and Tumblr.

• Gmail: Was affected; now it's patched. Google says you don’t need to, but just to be safe, you should probably change your password for the following Google services: Search, Gmail, YouTube, Wallet, Play, Apps, and App Engine. Google Chrome and Chrome OS were not affected.

And the ones that were not:

• AOL and Hotmail/Outlook.

Online shopping
Here are the ones that were vulnerable:

• eBay (partly): In a statement, eBay said "eBay is aware of the security vulnerability identified in a version of Open SSL, also known as the Heartbleed Bug. The vast majority of our services were not impacted and our users can continue to shop securely on our marketplace."

And the ones that were not:

• Amazon: Was not affected.  Amazon Web Services, which is a totally different system used by website owners, was affected - so, smaller sites you use could have been affected if they used Amazon for their hosting. But this is nothing to do with shopping on Amazon.

• PayPal: Was not affected.

Social networks
Here are the ones that were vulnerable:

• Tumblr was affected, but it has since been patched.

• Facebook: Was affected. According to the Telegraph, Facebook became aware of the issue before it was made public and has taken steps to ensure it was secure.

Pinterest: In a statement, Pinterest said: "This week we took steps with many other websites affected by Heartbleed in acting quickly to secure accounts. We fixed the issue on Pinterest.com, and didn’t find any evidence of mischief. To be extra careful, we e-mailed Pinners who may have been impacted, and encouraged them to change their passwords."

And the ones that weren't:

• Twitter: Apparently Twitter has ascertained that none of its servers were using SSL, the security format which Heartbleed exploits.

• LinkedIn: Was not affected.

Other important websites
Here are some more sites that were vulnerable, and have now restored their security:

• Dropbox

• OkCupid

• SoundCloud

• Netflix

• Airbnb

And the ones that were not:

• Apple: An Apple spokesperson told Yahoo Tech that “Apple takes security very seriously. iOS and OS X never incorporated the vulnerable software and key web-based services were not affected.” So, no need to change your password.

• Microsoft

• Evernote


A list of sites which were originally vulnerable can be found here. Many of these sites will by now have fixed the problem but please check with them before changing any password information.