Many big companies are still vulnerable to the biggest computer bug ever discovered, report says
Apr 7, 2015, 22:34 IST
It's taking companies such a long time to react because the vulnerability is so fundamental that merely patching the problem wouldn't do the trick. At the time it was discovered, security experts said that a complete overhaul would be necessary to fix the problem. Beyond patches, all keys and certificates would need to be revoked then replaced.
Most companies have not done this."Venafi has identified 580,000 hosts belonging to Global organizations that have not been completely remediated," writes the report.This means that although companies may have patched the problem (in fact, everyone company has), they haven't performed the second and third steps of revoking and replacing all of the necessary keys. These two tasks are necessary to fend off future attacks."Failure to revoke the old certificate enables the attacker to use the old certificate in phasing campaigns against the organization and its customers," Venafi explains.In short, unless all bases are covered, attackers can still attack these companies and gain access to this private data.