Snappy, The HostGator Mascot

Gator Crossing

The Official HostGator Company Blog!


Heartbleed Bug

Written by Sean Valant

Thursday, April 10th, 2014

You may have now heard of the “Heartbleed Bug.” Before we continue, we want to reassure you that if you are hosting on a HostGator shared or reseller server, that your server has already been patched. For everyone else, HostGator customer or not, we have created the following tool to assist you with determining whether or not your site is presently vulnerable and what further action to take, if necessary:

heartbleed bug

Now, what exactly is the Heartbleed Bug? Technically speaking, it is a serious vulnerability in the popular OpenSSL cryptographic software library. In layman’s terms, it allows the ever-present nefarious individuals the ability to intercept and decode encrypted data. The following quote comes from

“The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.”

The bug is so-named due to a normal function between two computers across a network (such as the Internet) sharing an encrypted connection. The “heartbeat” is simply a pulse, or packet of information, sent from one machine to the other to ensure the connection still exists. This functionality is what allows the exploit to occur, in that the heartbeat is simulated by a third party in such a way as to allow them access to the memory of the receiving server.

What this translates to is virtually unlimited, and untraceable, access to a myriad of private information which potentially can include usernames, passwords, and even credit card information. The full extent of the situation is not presently known. What is known is that we should all consider all of our passwords to be compromised. As a result, you absolutely want to update any passwords for anything and everything you log into online. However, if you change your password for an account on a server that has not been patched, then you can consider the new password compromised as well.

For full information regarding this situation, we recommend reading the associated Wikipedia article.

Posted in

News Bites, Web and Hosting Tips, Web Hosting News

5 Responses to Heartbleed Bug

  1. vercordio says:

    Thanks for this update. Do we need to change all of our HostGator passwords (account, domain, email, mysql, etc?)

    • LaurelNev says:

      I have the same question. Commenting so Disqus will notifty me when there is a response. :)

      • HostGator says:

        While we have no evidence to indicate any compromise within our network has taken place, we do recommend taking this opportunity to change all of your passwords, simply because it is a good practice to maintain.

  2. badycool says:

    This is scary…..I’had just changed my critical accounts password as this issue raised

  3. Mitesh Ganatra says:

    Also, following is recommended:

    – Generate a new SSL/TLS key and re-issue a new certificate for the new key. (An attacker could potentially have your old key.)

    – Have your users, and you, change the passwords used to log in to your site. It is advisable to change all sensitive user ID’s and Passwords that you may use.