3 ms·

I've tweeted what I know: https://twitter.com/bengrubb/status/455603832806842368 https://twitter.com/bengrubb/status/455603832806842368 https://twitter.com/be

• notjosh 13y ago
  To save someone else the clicking, these are: > A source close to CBA tells me only CBA's main website was impacted by #Heartbleed. It uses Amazon ELB, which was vulnerable (cont...) > Main CBA website now has a new certificate dated Friday, April 11 (you can check yourself in your web browser) (cont) #Heartbleed > Now, considering CBA's main website was vulnerable, according to source, it could've been subject to a man in the middle attack #heartbleed > An attacker could've sat in between connection on Wi-Fi or on carrier side and seen who visited site. So they only get IPs #heartbleed > Next question becomes could attacker have used man in middle to change iframe login on main CBA site to collect credentials? #Heartbleed