In the Netherlands, government websites, including its digital ID login service, have become unavailable. Finland has taken public services offline, and Wikimedia, the organisation behind Wikipedia, has switched off some of its systems too. This sounds like the results of a cyber-attack.
In most instances, however, the people running the sites deliberately switched them off because the alternative – keeping them online – was too risky. The future is here, and suddenly much of our digital infrastructure is looking very fragile. The websites were turned off because of two serious security vulnerabilities in PHP, a programming language that is used by about 70% of websites that we can track.
Those vulnerabilities in effect gave hackers an open window through which to climb and loot everything within. That could mean an attacker getting into an online shop, stealing customers’ addresses and passwords, or changing its checkout page to harvest card details. The UK’s National Cyber Security Centre advised organisations that were unable to update immediately to consider taking their systems offline.
It’s very tricky to get people to care about something quite so techy. PHP is a tricky abbreviation – even explaining what it stands for (PHP: Hypertext Preprocessor) is complicated, because it’s recursive. And how it helps the web work is also difficult to explain: a good analogy is it’s like the back-of-house team in a restaurant: your browser puts in an order, and PHP handles the cooking and delivers the meal.
In any case, what matters is that you’ve almost certainly used websites powered by it this week. I’ve been reporting on scares like these in our digital architecture for more than a decade, and the underlying problem barely changes. In 2014, I wrote about Heartbleed, a vulnerability in OpenSSL, the software that helps keep communications across the internet secure.
It was up to two men named Steve – working for OpenSSL on a shoestring budget and shouldering an awful lot of responsibility – to keep us from disaster. Twelve years later, it feels like we’re still having the same conversation. Heartbleed wasn’t the end of it.
Extract — continue reading at the source.
