A team of researchers say they believe the infamous Heartbleed bug was not the target of widespread attacks before it was publicly disclosed in April.
In a paper titled ‘The Matter of Heartbleed’, researchers from the University Illinois; University of Michigan; Purdue University; University of California, Berkeley; EECS and the International Computer Science Institute examined the impact of the Heartbleed vulnerability and found no evidence the bug was being exploited before it was revealed publicly five months ago.
“We investigated the attack landscape, finding no evidence of large-scale attacks prior to the public disclosure, but vulnerability scans began within 22 hours,” according to the paper. “We observed post-disclosure attackers employing several distinct types of attacks from 692 sources, many coming from Amazon EC2 and Chinese ASes [autonomous systems].”
What the researchers did find was a mixed bag in terms of responses by affected organizations. Their investigation revealed that within the first 24 hours, all but five of the Alexa Top 100 sites were patched, and that within 48 hours all of the vulnerable hosts in the top 500 were patched.
