Information Services would like to alert the WSU community to a new and serious flaw impacting some versions of OpenSSL, a common web site encryption software used by approximately two-thirds of the servers on the internet.
This OpenSSL flaw, known as Heartbleed, has the possibility of exposing the personal data of millions of users by allowing malicious parties access to the encryption keys to some of the web’s largest web services. Please note that at this time there is no indication that any sensitive or confidential WSU information has been exposed or compromised. WSU’s main web services were not exposed to or otherwise affected by this flaw.Information Services is monitoring the situation and continues to review WSU web services for potential vulnerabilities.
What’s important to know:
- Most major web sites corrected this flaw on their systems within hours of its discovery.
- It is possible that your passwords on many web sites could have been compromised before the flaw was corrected. WSU Information Services recommends changing your passwords to web sites that you use, especially those the most sensitive sites such as online banking or shopping that could provide access to your financial account information.
- WSU discourages using the same password for both your WSU accounts and non-WSU accounts. If you are currently using the same password for WSU access as well as other accounts, IS strongly recommends changing your WSU password to a new, unique password.
- Avoid online shopping for a few days, if you possibly can.
- Be very suspicious of any emails asking you to change passwords.
- Remember that legitimate college emails will never ask you to respond with sensitive information such as password, Social Security number, or bank account number.
- Apply the latest security updates to your home and work computers, as well as to your mobile devices.
To learn more about Heartbleed check out these additional resources:
Krebs on Security
https://krebsonsecurity.com/2014/04/heartbleed-bug-what-can-you-do/
The Chronicle of Higher Education
US-CERT
https://www.us-cert.gov/ncas/alerts/TA14-098A
For questions contact the Information Services Help Desk at 509-335-4357 or helpdesk@wsu.edu.
