Apple says Heartbleed security flaw did not affect its software or services

With an estimated half a million sites vulnerable to the “Heartbleed” vulnerability revealed earlier this week, which allows an attacker to access user details of websites previously believed to be secured by industry-standard SSL/TLS, your favorite social networks, stores, and other services around the web could potentially be handing out your password or other personal information to anyone who exploits the issue.

The bug exists in a library called OpenSSL, which is an open-source SSL implementation that many—but not all—web services use to secure sensitive traffic. If a website you use is affected by the bug, your personal data could be given to just about anyone. Unfortunately, changing your password on an unsecure site won’t even help unless the site’s owners have installed a fix (because the attackers can simply exploit the bug again to get your new password).

This serious issue affects a number of high-profile sites, but it seems your Apple ID is safe. Today, Apple gave the following statement to Re/code:

“Apple takes security very seriously. iOS and OS X never incorporated the vulnerable software and key web-based services were not affected.”

We used a tool for testing a site for the vulnerability that was released earlier this week, and can confirm that both apple.com, the various iTunes servers used for hosting Apple’s stores, and WordPress.com (the hosting system used for 9to5Mac and 9to5Google) are secure. Users running a web service powered by OS X 10.8 or 10.9 were also unaffected by this bug, as the server builds of those operating systems use the same (safe) encryption libraries as the consumer versions.