14 DAY TRIAL // The Canadian Police has announced that it has identified an individual that could be responsible for a Heartbleed data breach reported by the Canada Revenue Agency.
According to a statement, the issue had in fact been discovered last week, which prompted the Canadian authorities to shut down several sites in order to patch up the security hole, CBC reports.
During this time, the police was actually investigating the security breach that saw some 900 social insurance numbers being stolen.
“This deferral permitted us to advance our investigation over the weekend, identify possible offenders and has helped mitigate further risk,” the police said.
Originally, only the site belonging to the Canadian Revenue Agency was taken down, but other government sites followed later in the week. On Friday, the CRA realized that a six-hour attack that exploited the Heartbleed vulnerability stole 900 social insurance numbers.
However, the National Democratic Party wants to know whether the government could have done more to avoid the security breach in the first place, especially since it spent days patching the Heartbleed bug, which shouldn’t have taken so long.
The lengthy intervention and the fact that the sites weren’t taken down earlier may have allowed the hackers to steal the information without leaving a trace.
“What’s really disturbing is the lack of clarity on what CRA did when they found out about the Heartbleed bug,” said Charlie Angus, member of the Parliament.
Their justified concern is why it took so long for the CRA to patch the bug, especially since Heartbleed was exposed on Monday, and on Friday, the agency’s database was still not secure.
Heartbleed affects several versions of OpenSSL, which were used to secure about two thirds of the world’s websites. Attacks made by exploiting Heartbleed do not leave any traces on the affected servers, which makes it impossible to know how many times hackers used it or if there were any prior attempts.
This, of course, raises the question about how exactly the authorities managed to track down one or more hackers.
While many believe that Heartbleed was placed in OpenSSL on purpose, the programmer responsible for the massive security problem says that it was a simple error, with no malicious purpose. He also explained that he’d been working on OpenSSL and checking it for bugs for a long time.
If the error had happened in another area, it wouldn’t have been so dangerous, but due to its placement, it affected the security of billions of people.