Hackers From China Waste Little Time in Exploiting Heartbleed

Just one day after the Heartbleed bug was announced to the world, researchers spotted an attack exploiting it. Photographer: Jean Chung/Bloomberg

(Updates with latest data from University of Michigan in fourth graph)

For those who don't feel the urgency to install the latest security fixes for their computers, take note: Just a day after Heartbleed was revealed, attacks from a computer in China were launched.
The software bug, which affects a widely used form of encryption called OpenSSL, was announced to the world April 7 at 1:27 p.m. New York time, according to the Sydney Morning Herald. That sent companies scrambling to fix their computer systems -- and for good reason.
At 8:23 p.m. the following day, a computer in China that was previously used for hacking and other malicious activities tried to attack a server at the University of Michigan, said J. Alex Halderman, an assistant professor of electrical engineering and computer science. The university's computer was a "honeypot," which was intentionally left vulnerable and designed to attract attacks so researchers could study them.
The hackers' fast turnaround highlights how quickly the digital underworld is in taking advantage of newly disclosed software vulnerabilities. So far, 41 attempts to exploit the Heartbleed hole have been made on three honeypots operated by Halderman and his research team. About half have come from China. The attacks could include some attempts by other researchers trying to assess the impact of the bug.
Yahoo saw some of its user information spilled onto the Internet after waiting too long to fix the Heartbleed bug in its servers. The company said that it had fixed the problems on its main properties within 48 hours. It has now fixed the problem across all of its sites.