Have you been spending all your time trying to change each one of your passwords due to the threat of the "Heartbleed" bug? You might re-think wasting your time.
The bug that has threatened to expose data to hackers cannot be protected against by Internet users until vulnerable websites upgrade their software, Reuters reported.
Running a widely used Web encryption program known as OpenSSL that makes Web servers vulnerable to the theft of data, including passwords, confidential communications and credit card numbers, hacking groups have conducted automated scans of the Internet in search of these servers, security experts warned.
Even though about two-thirds of all Web servers use OpenSSL, the issue has gone undetected for about two years.
"Kurt Baumgartner, a researcher with security software maker Kaspersky Lab, said his firm uncovered evidence on Monday that a few hacking groups believed to be involved in state-sponsored cyber espionage were running such scans shortly after news of the bug first surfaced the same day," Reuters reported.
Reuters added, "By Tuesday, Kaspersky had identified such scans coming from 'tens' of actors, and the number increased on Wednesday after security software company Rapid7 released a free tool for conducting such scans."
"The problem is insidious," Baumgartner said. "Now it is amateur hour. Everybody is doing it."
Servers that host websites are the only ones that use Open SSL software. Since the bug exposes passwords and other data entered on those devices to hackers, it must be fixed by website operators.
Devices such as PCs or mobiles don't need to worry about this threat.
"There is nothing users can do to fix their computers," said Mikko Hypponen, chief research officer with security software maker F-Secure.
Measures have been taken to mitigate the impact of the bug on users, representatives for Facebook Inc., Google and Yahoo Inc. told Reuters
Google spokeswoman Dorothy Chou told Reuters, "We fixed this bug early and Google users do not need to change their passwords."
Ty Rogers, a spokesman for Amazon.com Inc., said, "Amazon.com is not affected."
