The Wayback Machine - https://web.archive.org/web/20140412210521/https://blogs.akamai.com/
 

Heartbleed Update

Today, we provided more information to our customers around the research we've done into the Heartbleed vulnerability.  As our analysis may inform the research efforts of the industry at large, we are providing it here. 
 
Summary: Akamai patched the announced Heartbleed vulnerability prior to its public announcement.  We, like all users of OpenSSL, could have exposed passwords or session cookies transiting our network from August 2012 through 4 April 2014.  Our custom memory allocator protected against nearly every circumstance by which Heartbleed could have leaked SSL keys.  There is one very narrow window through which 4 Akamai server clusters had a vulnerable release for 9 days in March 2013.  For the small number of customers potentially affected, we are pro-actively rotating certificates.
 
All certs issued on or after 1 April 2013 are certainly safe.
 
Please read below for more details on this issue.

Missed #NABshow? We've Got You Covered!

If you follow us on Twitter, you may have noticed that we were live tweeting at the NAB Conference in Las Vegas this past week. There was plenty going on, and 98,000 people attending from 150 different countries. Weren't able to make it out to Las Vegas this year? We've compiled all of our tweets from this past week, to get you up to date on what was talked about at NAB this year. Read our Twitter stream to follow the events and talks over the past week. Enjoy!

SOURCE Boston: Fighting Security Burnout

If you're attending SOURCE Boston, there's a discussion Thursday at 11 a.m. you should attend. It deals with a subject we've been working hard to address at Akamai: burnout in the security industry, and how we can make things better by tapping into the better angels of our nature.



OPEN Thoughts

It was only six months ago that Akamai opened its core technology, revealing the Open Platform Initiative strategy. The main idea was to enable everyone; every developer, every customer and every partner, to access Akamai technology and benefit from its amazing power. You may arguably say that this was a small step on a long path. But let's look back and see how much we walked, using the evolution of technology as our context.

As technology has evolved, there were milestones that changed the way we use it in our lives, milestones that changed and improved things forever. More importantly, technology plays a key role in the way we all behave, communicate, learn, share and spend our leisure time. Technology is now part of our lives, as it was never before.

SOURCE Boston 2014: Need a Job? Stop By Our Table

Attention, SOURCE Boston attendees: If you or anyone you know needs a job, come by our booth. Recruiters are on hand, and they have several positions to fill, including:

  • A program manager for InfoSec;
  • A senior manager for Enterprise Security;
  • A security architect for Adversarial Resilience; and 
  • A principal application software engineer for the Security Products Group.
We're also giving away an iPad at 5 p.m., so come put your business card in the raffle jar. And by all means, come grab some shwag.

10006383_10203740995191803_846107286495733959_n.jpg

SOURCE Boston 2014: Proof Heartbleed is a Big Deal

Akamai CSO Andy Ellis wrote about how we're protecting customers from the much-publicized Heartbleed vulnerability OpenSSL fixed in an update Monday. At SOURCE Boston 2014, there's plenty of personal proof that this bug is a big deal. You could say it ruined the first day of the conference for some.

Update 2014-04-11: Updated information on our later analysis here.

We're getting a lot of questions about the OpenSSL Heartbleed fix. What follows are the most commonly asked questions, with our answers.

The Heartbleed bug affects a heartbeat functionality within the TLS/DTLS portion of the library. It allows the attacker to -- silently and without raising alarms -- dump portions of the servers memory to the client. This can allow the attacker to walk through the memory space of the server, possibly dumping private SSL keys and certainly exposing important secrets.

All versions of the OpenSSL library between 1.0.1 and 1.0.1f contain the Heartbleed bug and should be updated to 1.0.1g as soon as possible. (The vulnerability researchers have posted their analysis, and an excellent analysis is up on Sean Cassidy's blog.


Fix Released for Heartbleed OpenSSL Flaw

A fix is now available for a serious Open SSL flaw known as Heartbleed. The vulnerability, covered in CVE-2014-0160, affects OpenSSL 1.0.1 through 1.0.1f with two exceptions: OpenSSL 1.0.0 branch and 0.9.8.

SOURCE Boston 2014: Talk Descriptions

SOURCE Conference 2014 runs tomorrow through Thursday at the Marriott on Tremont Street, Boston. Akamai is a platinum sponsor of the event and we hope to see you there. To help attendees acclimate, we're sharing the following talk descriptions, which are also available on the conference website.

After yesterday's post on booth babes, I heard from a lot of people who agree vendors need to find other ways to attract attention during security conferences. One reader correctly noted that this unfortunate phenomenon isn't the result of bad intentions. It's just that some marketing teams don't know any better. They assume the booth babes work because they see others using them.

What to do about it? Give marketing practitioners some examples of successful exhibits that succeeded without the sexism.

Here are four examples of exhibits that won on the strength of the security message. They use other gimmicks, to be sure, but in my opinion they are more about creativity than exploitation. Feel free to disagree with what follows, or share other examples of displays that worked.