DV Hardware - bringing you the hottest news about processors, graphics cards, Intel, AMD, NVIDIA, hardware and technology!
   Home | News submit | News Archives | Reviews | Articles | Howto's | Advertise
DarkVision Hardware - Daily tech news
May 24, 2019 
Main Menu
News archives

Who's Online
There are currently 59 people online.


Latest Reviews
Ewin Racing Flash gaming chair
Arctic BioniX F120 and F140 fans
Jaybird Freedom 2 wireless sport headphones
Ewin Racing Champion gaming chair
Zowie P-TF Rough mousepad
Zowie FK mouse
BitFenix Ronin case
Ozone Rage ST headset

Follow us

NSA reportedly knew about Heartbleed for at least 2 years

Posted on Monday, April 14 2014 @ 16:21:31 CEST by

The Tech Report writes anonymous sources informed Bloomberg that the NSA has known about the Heartbleed bug in OpenSSL for at least two years and used to bug on a regular basis to gather critical intelligence:
A recent story by Bloomberg quotes two unnamed sources "familiar with the matter" who claim the NSA has known about the Heartbleed bug for "at least two years." The NSA, those sources claim, "regularly used [the bug] to gather critical intelligence," all the while making no effort to alert OpenSSL's developers to the problem. As Bloomberg goes on to say:

Putting the Heartbleed bug in its arsenal, the NSA was able to obtain passwords and other basic data that are the building blocks of the sophisticated hacking operations at the core of its mission, but at a cost. Millions of ordinary users were left vulnerable to attack from other nations' intelligence arms and criminal hackers.
The Office of the Director of National Intelligence refuted the claims and said the Federal government was not aware of the Heartbleed bug until it was made public by private security researchers. Interestingly, the statement also mentions that Federal agencies disclose vulnerabilities rather than to hold it for investigative or intelligence purpose, unless there is a "clear national security or law enforcement need":
When Federal agencies discover a new vulnerability in commercial and open source software – a so-called "Zero day" vulnerability because the developers of the vulnerable software have had zero days to fix it – it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose.

In response to the recommendations of the President's Review Group on Intelligence and Communications Technologies, the White House has reviewed its policies in this area and reinvigorated an interagency process for deciding when to share vulnerabilities. This process is called the Vulnerabilities Equities Process. Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities.



DV Hardware - Privacy statement
All logos and trademarks are property of their respective owner.
The comments are property of their posters, all the rest © 2002-2019 DM Media Group bvba