> A source close to CBA tells me only CBA's main website was impacted by #Heartbleed. It uses Amazon ELB, which was vulnerable (cont...)
> Main CBA website now has a new certificate dated Friday, April 11 (you can check yourself in your web browser) (cont) #Heartbleed
> Now, considering CBA's main website was vulnerable, according to source, it could've been subject to a man in the middle attack #heartbleed
> An attacker could've sat in between connection on Wi-Fi or on carrier side and seen who visited site. So they only get IPs #heartbleed
> Next question becomes could attacker have used man in middle to change iframe login on main CBA site to collect credentials? #Heartbleed