P2P Sites and HeartBleed Bug

Thincats have issued the following statement (by email to lenders)

"Password Security: The Heartbleed Bug
You may be aware that a serious vulnerability has just been discovered in the immensely popular OpenSSL cryptographic software library. OpenSSL is the most widely used implementation of a suite of security protocols that help encrypt traffic while surfing the web. This vulnerability (called the Heartbleed Bug) is worrying as it allows anyone to read the memory of systems protected by vulnerable versions of the OpenSSL software. Someone with malicious intent could read this memory, grab the secret keys the service uses to encrypt the traffic, names and passwords of the users and then retrieve all sorts of private data.

How does this affect ThinCats?
Fortunately the ThinCats platform was unaffected because it uses a version of the software that is not as risk from the Heartbleed bug. However if you use the same password on multiple websites it is possible that your ThinCats account may still be vulnerable. As a security precaution we recommend that any member who uses the same password on several different websites changes their ThinCats password immediately."

Possibly a slight over-reaction. Banks are required to protect you from online fraud provide you have taken basic security measures (Eg not publishing passwords on facebook). Most Banks will have added a second data input screen for access as additional protection. Any passwords which involve selected letters or dropdown boxes are likely to be fairly safe.  P2P sites, unfortunately are less secure, the worst offenders are those which make it easy to enter any bank details for withdrawal and have only a single stage user/password entry page.

Bondora was affected and fixed it and replaced their server SSL certificate on Wednesday night. They revoked their old certificate so that anyone who was able to use the vulnerability to steal Bondora's private key could not use the old certificate to impersonate them. It's now prudent to change passwords there.

Now is a bad time to be going and logging in to lots of places that have not been fixed because that just puts you at higher risk by putting your login information into RAM where it could be taken. Best to give it a week or so before mass password updating.

You can click on the names to check each one in this list, here's the decoding key for what the descriptions mean:

A/B/C/F etc is the overall SSl security rating from the checking service and any other comments it has to explain the rating. F means using known insecure things, roughly, even if not vulnerable to heartbleed.
not currently vulnerable: not vulnerable at the time I checked, says nothing about whether it was vulnerable in the past.
old certificate: either never vulnerable or not yet fully completed the work of fixing.
new certificate: certificate from after the fix became known. Probably used to be vulnerable but only probably.

assetzcapital.co.uk: B not currently vulnerable, old certificate
auxmoney.com@ A- not currently vulnerable, old certificate
Bondora.com: A+ not vulnerable any more, was vulnerable before Wednesday, new certificate
communitae.com: A not currently vulnerable, new certificate
finansowo.pl: A- not currently vulnerable, old certificate
fixura.com: A- not currently vulnerable, old certificate
fixura.co.uk: A- not currently vulnerable, old certificate
folk-folk.com: F certificate mismatch with domain, certificate issued to secure33.prositehosting.co.uk. not currently vulnerable, old certificate
fundingcircle.com: B not currently vulnerable, old certificate
fundingknight.com: B not currently vulnerable, old certificate
fundingsecure.com: A- not currently vulnerable, old certificate
geldvoorelkaar.nl: F, uses obsolete and insecure SSL2, not currently vulnerable, old certificate
Kokos.pl: B, not currently vulnerable, old certificate
lendingclub.com: A-, not currently vulnerable, old certificate
myc4.com: F, uses obsolete and insecure SSL2, not currently vulnerable, old certificate
pret-dunion.fr: B, uses only older protocols, not currently vulnerable, old certificate
prosper.com: B, not currently vulnerable, old certificate
ratesetter.com: F but probably not relevant, see next entry
members.ratesetter.com: F, uses obsolete and insecure SSL2, not currently vulnerable, old certificate
rebuildingsociety.com: B, not currently vulnerable, old certificate
smartika.it: F, APPEARS VULNERABLE TO HEARTBLEED TODAY, old certificate
smava.de: A-, not currently vulnerable, old certificate
thincats.com: C, vulnerable to CRIME attack, only older protocols, no secure negotiation support, not currently vulnerable, old certificate
wellesley.co.uk: F, supports anonymous suites, not currently vulnerable, old certificate
Zopa: B, not currently vulnerable, old certificate.

Note that the test result descriptions come from the testing service, not me except to summarise them.

It's also worth noting that except in a few cases the test uses the obvious server name and they might use more secure versions for logins and member sessions than for the main site. Ratesetter did this sort of thing, not having SSL for the main site but for logins and presumably other things. Where I did followup tests I left just the main link so you can see what I did to get to a testable server.

According to the test report they are still vulnerable to other attacks like CRIME. Using old stuff means that they didn't have the update from two years ago that introduced the heartbleed vulnerability, or were using something other than OpenSSL that has the problems described in the report.

I assume that they will fix this given all of the current attention so I suggest that you do no more for a week or so than asking them to look at the test result and fix the issues reported compared to say Bondora that does a lot of things right even if it was affected, and received the best rating of all I checked.

Don't over-react to the test results. While they are significantly less good than for many others things could be far worse.

If you are using LastPass to manage your passwords, you can run their security check to see if any of your sites are a problem.

This question has been raised and responded to on one of the TC fora. Extract from response:

... The person who made the original post did point out that the tests were done on the most obvious server (this case the one used by http://www.thincats.com). It should be noted that the actual ThinCats platform is hosted at app.thincats.com and uses a different server...
(Original post includes link to test results, omitted here because it was published on a private forum)
There are of course still areas that we can improve on, but it is important to note that the main platform is not vulnerable to CRIME attacks.