Google and BlackBerry have acknowledged that certain Android phones and BBM are vulnerable to Heartbleed, a bug affecting up to two-thirds of the internet.
Android phones running 4.1.1 Jelly Bean are vulnerable but all other versions of Android appear immune to the issue. Google's resources list 4.1.x as powering 34 per cent of all Android devices.
Heartbleed could allow a malicious party to query sensitive data within a mobile browser. For example, an attacker could load malware into one tab and use it to steal bank data from another tab open to a user's banking site. They could not steal data from other apps because of Android's design.
"If you have a vulnerable device and there's no fix available for you, I would be very cautious about using that device for sensitive data," security researcher Marc Rodgers told Ars Technica.
Google says it is working on distributing fixes to Android partners. However, this places the burden of updating affected phones on OEM partners who often do not send patches. Adoption rates for new versions of Android are notoriously low.
BlackBerry is working on a fix for its services as well. It plans to release a patch for BlackBerry Messenger for Android and iOS to fix Heartbleed by Friday.
While most BlackBerry services do not use OpenSSL (the encryption compromised by Heartbleed), the company does use it with BBM and Secure Work Space corporate mail.
"The level of risk here is extremely small," said BlackBerry senior vice president Scott Totzke. "It's a very complex attack that has to be timed in a very small window."
BlackBerry's website claims its services are still secure, even with the bug. It says BBM and Secure Work Space are designed to connect only to "a known and trusted end point."
Heartbleed has rocked the web, as it compromises OpenSSL. OpenSSL is used as the basic encryption service in HTTPS, TLS, and other online services.
To check if your phone is affected by Heartbleed, download the Heartbleed Detector from Lookout Mobile Security.
-
Zoom exec on making sure we lead the change we want to seeIn-deoth “Some people think diversity is the responsibility of people and HR teams. And it's not.”
-
Opera browser thinks it has the solution to stopping ClickFix malware attacksNews The browser company is targeting a growing source of malicious links with its new Paste Protect feature
-
OpenAI expands 'Daybreak' cyber program: New tools, partnerships, and a cyber-focused GPT-5.5 aim to help 'patch the world'News The company has added new tools, signed up partners, and released its GPT-5.5-Cyber model more widely
-
AI is shrinking attack windows, and it’s forcing a complete rethink of cyber resilience – here’s how organizations can prepareNews Commvault has urged companies to improve their business continuity and resilience plans in the face of flaws spotted by AI
-
Anthropic targets vulnerability detection gains with Claude Security public beta — here's what users can expectNews The Claude Mythos developer is aiming for a more limited approach to cyber tooling for public consumption
-
Researchers warn millions of RDP and VNC servers are wide open to exploitationNews Researchers at Forescout spotted millions of RDP and VNC servers exposed online
-
Brace yourselves for a vulnerability explosion, Forescout warnsNews AI advances are helping identify software flaws at record pace and scale, but that's not the good news some would think
-
Ubuntu vulnerability exposes enterprises to root escalation, complete system compromiseNews The high-severity Ubuntu vulnerability allows an unprivileged local attacker to escalate privileges through the interaction of two standard system components
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
