Advertisement

We need your help now

Support from readers like you keeps The Journal open.

You are visiting us because we have something you value. Independent, unbiased news that tells the truth. Advertising revenue goes some way to support our mission, but this year it has not been enough.

If you've seen value in our reporting, please contribute what you can, so we can continue to produce accurate and meaningful journalism. For everyone who needs it.

heartbleed image via Shutterstock
Canada

19-year-old arrested for using Heartbleed to steal taxpayers' data

The Canada Revenue Agency said 900 social insurance numbers were stolen from its website.

FEDERAL POLICE IN Canada said they have arrested and charged a 19-year-old man in the theft of 900 taxpayers’ data, which was made vulnerable by the “Heartbleed” bug.

The Royal Canadian Mounted Police (RCMP) said Stephen Arthuro Solis-Reyes was arrested at his London, Ontario home on Tuesday without incident.

He is scheduled to appear in court today to face charges of mischief and unauthorized use of a computer to steal data from the Canada Revenue Agency (CRA)’s website.

“It is believed that Solis-Reyes was able to extract private information held by the CRA by exploiting the security vulnerability known as the Heartbleed Bug,” the RCMP said in a statement.

The suspect was tracked down within four days after what CRA Assistant Commissioner Gilles Michaud had described as a serious security breach.

Police said computer equipment was seized at the suspect’s home, and that the investigation is still ongoing.

The Canada Revenue Agency said 900 social insurance numbers – personal nine-digit codes required for working or accessing government benefits in Canada – had been stolen last week by “someone exploiting the Heartbleed vulnerability.”

Its website was shuttered for several days over concerns about the Heartbleed bug.

It was rebooted over the weekend after a patch was installed.

The recently-discovered flaw in online-data scrambling software OpenSSL allows hackers to eavesdrop on online communications, steal data, impersonate websites and unlock encrypted data.

OpenSSL is commonly used to protect passwords, credit card numbers and other data sent via the Internet.

More than half of websites use the software, but not all versions have the same vulnerability, according to heartbleed.com.

Cybersecurity firm Fox-It estimates that the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.

- © AFP 2014.

Read: Heartbleed causes massive online scare – but don’t change your passwords just yet>

Read: ‘Heartbleed’ security bug leaves encrypted web servers at risk

Your Voice
Readers Comments
11
    Submit a report
    Please help us understand how this comment violates our community guidelines.
    Thank you for the feedback
    Your feedback has been sent to our team for review.