'Heartbleed' bug exposes passwords