NSA reportedly knew about Heartbleed for at least 2 years

Posted on Monday, Apr 14 2014 @ 16:21 CEST by Thomas De Maesschalck
The Tech Report writes anonymous sources informed Bloomberg that the NSA has known about the Heartbleed bug in OpenSSL for at least two years and used to bug on a regular basis to gather critical intelligence:
A recent story by Bloomberg quotes two unnamed sources "familiar with the matter" who claim the NSA has known about the Heartbleed bug for "at least two years." The NSA, those sources claim, "regularly used [the bug] to gather critical intelligence," all the while making no effort to alert OpenSSL's developers to the problem. As Bloomberg goes on to say:

Putting the Heartbleed bug in its arsenal, the NSA was able to obtain passwords and other basic data that are the building blocks of the sophisticated hacking operations at the core of its mission, but at a cost. Millions of ordinary users were left vulnerable to attack from other nations' intelligence arms and criminal hackers.
The Office of the Director of National Intelligence refuted the claims and said the Federal government was not aware of the Heartbleed bug until it was made public by private security researchers. Interestingly, the statement also mentions that Federal agencies disclose vulnerabilities rather than to hold it for investigative or intelligence purpose, unless there is a "clear national security or law enforcement need":
When Federal agencies discover a new vulnerability in commercial and open source software – a so-called "Zero day" vulnerability because the developers of the vulnerable software have had zero days to fix it – it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose.

In response to the recommendations of the President's Review Group on Intelligence and Communications Technologies, the White House has reviewed its policies in this area and reinvigorated an interagency process for deciding when to share vulnerabilities. This process is called the Vulnerabilities Equities Process. Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities.


About the Author

Thomas De Maesschalck

Thomas has been messing with computer since early childhood and firmly believes the Internet is the best thing since sliced bread. Enjoys playing with new tech, is fascinated by science, and passionate about financial markets. When not behind a computer, he can be found with running shoes on or lifting heavy weights in the weight room.



Loading Comments