heartbleed

With an estimated half a million sites vulnerable to the “Heartbleed” vulnerability revealed earlier this week, which allows an attacker to access user details of websites previously believed to be secured by industry-standard SSL/TLS, your favorite social networks, stores, and other services around the web could potentially be handing out your password or other personal information to anyone who exploits the issue.

The bug exists in a library called OpenSSL, which is an open-source SSL implementation that many—but not all—web services use to secure sensitive traffic. If a website you use is affected by the bug, your personal data could be given to just about anyone. Unfortunately, changing your password on an unsecure site won’t even help unless the site’s owners have installed a fix (because the attackers can simply exploit the bug again to get your new password).

This serious issue affects a number of high-profile sites, but it seems your Apple ID is safe. Today, Apple gave the following statement to Re/code:

“Apple takes security very seriously. iOS and OS X never incorporated the vulnerable software and key web-based services were not affected.”

We used a tool for testing a site for the vulnerability that was released earlier this week, and can confirm that both apple.com, the various iTunes servers used for hosting Apple’s stores, and WordPress.com (the hosting system used for 9to5Mac and 9to5Google) are secure. Users running a web service powered by OS X 10.8 or 10.9 were also unaffected by this bug, as the server builds of those operating systems use the same (safe) encryption libraries as the consumer versions.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

5 Responses to “Apple says Heartbleed security flaw did not affect its software or services”

  1. thejuanald says:

    That’s good to hear, nice job Apple

  2. Well, good news for my Apple stuff, but what about my Amazon Account? Oops I guess “Purchase with your Amazon Account” has a whole new meaning. Apple using iTunes as the basis of a “middleman” secure funds program got a whole lot more interesting. They start that program going in China with Alibaba and they’ll flip a lot more cash than Amazon processing those ¥

  3. This is one of the reasons i love apple products

  4. Yeah, they’re not silly enough to use OpenSSL. Apple, to my knowledge, uses its own encryption algorithms for just about everything.