21 April 2014 – Trend Micro has previously discussed various aspects of the Heartbleed vulnerability in OpenSSL. Last Tuesday, our first blog post covered an analysis of the vulnerability itself, as well as some steps that IT administrators of affected systems could do in order to protect themselves. Later entries looked at how popular websites and mobile apps were, in their own ways, vulnerable to the threat.
To help deal with the Heartbleed vulnerability, Trend Micro has now released several tools that can be used to detect possible exposure to the risks:
We have released into the Google Play app store the Trend Micro Heartbleed Detector. This tool is designed to help users tell if they are vulnerable to any aspect of this threat. In particular, it checks for three things:
- It checks whether the version of OpenSSL used in the device’s version of Android may be vulnerable.
- It checks whether any OpenSSL libraries embedded in the user’s installed apps may be vulnerable.
- It checks whether the user’s installed apps communicate to any unpatched (and therefore, vulnerable) servers.
If any vulnerable apps are detected, the detector offers to uninstall the app for the user:
Trend Micro doesn't recommend for users to immediately uninstall all vulnerable apps, but this is something everyone should consider for applications that handle critical information, such as mobile banking applications. In addition, it’s a good idea for users to contact the companies that maintain these vulnerable apps to update their apps or websites as soon as possible.
For Chrome users, we’ve also released the Trend Micro OpenSSL Heartbleed Scanner app. The scanner allows for users to check if specific sites are vulnerable to Heartbleed. The tool can be downloaded from the Chrome Web Store.
For other users who want to check if a site is vulnerable or not, you may also do so through our Trend Micro Heartbleed Detector website.
FOLLOW us on our Twitter
LIKE us on our FaceBook
SUBSCRIBE to us on our YouTube Channel!
