WASHINGTON — Hundreds of thousands of corporate computer servers, routers, and other Internet devices worldwide remain vulnerable to the Heartbleed Web-security flaw nearly six months after its existence was disclosed, security researchers say.
More than half of the Forbes Global 2000 listing of the world’s most profitable companies have servers that are still not fully protected, according to the security company Venafi Inc., which electronically probed them Aug. 22.
‘‘We expect that the most sophisticated attackers will use this at the time of their liking,’’ Kevin Bocek, Venafi’s vice president for security strategy and threat intelligence, said in a phone interview.
He declined to name any companies found to be vulnerable, though said many were in the health care, retail, and banking sectors. The biggest public company known to be hacked through Heartbleed was Community Health Systems Inc., which disclosed Aug. 18 it had been attacked in April and June.
Separately, Errata Security, a consulting company based in Atlanta, scanned publicly available devices on the Internet on June 20 and found as many as 300,000 routers, servers, and other Internet devices were still vulnerable.
The lag in responding to one of the most widespread Internet vulnerabilities ever uncovered means hackers can still intercept user names, passwords, and other sensitive data, just as they did by stealing 4.5 million patient records from Community Health earlier this year.
Chinese hackers exploited Community Health’s Heartbleed vulnerability more than a week after the security hole was publicized, said a person involved in the investigation. The timetable illustrates how attackers often move faster than corporate security teams to exploit flaws once they become known.
Community Health, which was required to notify patients and regulators of the security breach, said in an Aug. 18 regulatory filing that it ‘‘completed eradication of the malware from its systems and finalized the implementation of other remediation efforts that are designed to protect against future intrusions of this type.’’ The company did not say whether the breach occurred due to Heartbleed.
After the Heartbleed vulnerability was disclosed, much attention was focused on concerns that websites might be hacked. But it is possible that the devices that companies depend on to connect to customers, medical patients, and users are most vulnerable to the flaw, Kevin Hamlen, an associate professor at the University of Texas in Dallas, said in a phone interview.
Heartbleed is a programming mistake in OpenSSL, used by companies to secure traffic flowing between servers and computers. SSL refers to an encryption protocol known as Secure Sockets Layer, and its use is indicated by a closed padlock appearing on browsers next to a website’s address.
Venafi found 1,219 companies on the Forbes Global 2000 had a combined 448,000 servers that were not fully secured from Heartbleed. The company sent automated browser requests to the firms to look for hardware and software vulnerabilities and recorded the publicly available information that was returned.
Although security patches had been applied, encryption keys and digital certificates that provide trust and privacy for consumer protection remained unchanged, Venafi found.
‘‘Definitely expect more’’ companies to find out they have been infiltrated through the flaw, said Jeff Horne, who investigates data breaches as vice president of research and development and chief architect at Accuvant Inc., a security firm based in Denver. ‘‘It takes people forever to patch.’’
Heartbleed, which existed for two years before the public was alerted to the flaw April 7, lets hackers steal the secret keys protecting user names, passwords, and other digital data. With keys in hand, hackers can infiltrate deeper into a company’s network to obtain other data.