A missing bounds check in OpenSSL code created the internet's most catastrophic security bug.
In short: In 2014, the world learned that a tiny coding error in a widely used cryptography library allowed attackers to silently siphon sensitive data from server memory. Known as Heartbleed, this vulnerability exposed passwords, session cookies, and private keys, leaving millions of internet-connected devices and major services dangerously vulnerable to exploitation.
Heartbleed, officially registered as CVE-2014-0160, originated from a 2012 implementation of the TLS heartbeat extension. The bug was a classic buffer over-read: the software failed to validate the length of incoming heartbeat requests. If a user requested a small payload but claimed it was large, the server would return the requested data plus whatever sensitive information happened to reside in the adjacent memory buffer. This flaw allowed attackers to scrape up to 64 kibibytes of memory per request, potentially capturing authentication secrets or private encryption keys.
The vulnerability was introduced into the OpenSSL source code on 31 December 2011 by Stephen N. Henson, who failed to notice the error in code submitted by Ph.D. student Robin Seggelmann. It remained hidden until April 2014, when it was independently discovered by Google’s security team and the Finnish firm Codenomicon. While many organizations patched their systems quickly, the cleanup was slow. As of 21 June 2014, over 300,000 public web servers remained vulnerable, and years later, tens of thousands of internet-connected devices still had not been updated.
The fallout was widespread. The Canada Revenue Agency suffered a theft of 900 social insurance numbers, and Community Health Systems saw 4.5 million patient records compromised. Beyond servers, the bug also affected clients in a scenario dubbed Reverse Heartbleed, where malicious servers could exploit vulnerable software on a user's device. Despite the severity, the bug’s history remains contested; some reports alleged the NSA kept the flaw secret for intelligence gathering, a claim the agency denied. The incident ultimately forced a shift in U.S. policy, prioritizing the elimination of software vulnerabilities over their exploitation for surveillance.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: Heartbleed
To cite this card, link to https://intellectplus.co.uk/app/culture-heartbleed.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Languages · More in Cultures · Latest · A–Z · All topics
