The Matter of Heartbleed

TLDR

Heartbleed, discovered in April 2014, was one of the most consequential Internet vulnerabilities, enabling remote memory reads on roughly 24–55 % of popular HTTPS sites. This study aims to comprehensively analyze Heartbleed’s impact by tracking vulnerable sites, monitoring patching, assessing the HTTPS certificate ecosystem, and exposing real exploitation attempts, then drawing lessons for future community responses. We performed a measurement-based analysis of the vulnerable population, patching behavior, certificate effects, and real attacks, and conducted a large-scale notification experiment on 150 000 hosts. The notification experiment yielded a nearly 50 % increase in patching among notified hosts.

Abstract

The Heartbleed vulnerability took the Internet by surprise in April 2014. The vulnerability, one of the most consequential since the advent of the commercial Internet, allowed attackers to remotely read protected memory from an estimated 24--55% of popular HTTPS sites. In this work, we perform a comprehensive, measurement-based analysis of the vulnerability's impact, including (1) tracking the vulnerable population, (2) monitoring patching behavior over time, (3) assessing the impact on the HTTPS certificate ecosystem, and (4) exposing real attacks that attempted to exploit the bug. Furthermore, we conduct a large-scale vulnerability notification experiment involving 150,000 hosts and observe a nearly 50% increase in patching by notified hosts. Drawing upon these analyses, we discuss what went well and what went poorly, in an effort to understand how the technical community can respond more effectively to such events in the future.