NSA Said to Exploit Heartbleed Bug for Intelligence for Years

http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html

by taylorbuley • 12 years ago

323 159 12 years ago

tptacek10• 12 years ago

Yeah, that's not good.

jobu• 12 years ago

This looks like another case where the actions of the NSA are the opposite of what's in the best interest of US Citizens.

onewaystreet3• 12 years ago

Was it though? The NSA's job is to spy on behalf of the country. While keeping the bug a secret put people at risk, there is an argument to be made that it was a useful tool. Law enforcement regularly makes the decision to allow low level criminals to continue to commit crimes in order to catch their leaders even though doing so puts people at risk. There are always tradeoffs.

ihsw• 12 years ago

Where do we draw the line? When millions die and billions of dollars in irrecoverable damage is done?

Who gets to decide whether the risk is acceptable? To whom do we turn to when it's found that their risk assessment was flawed, and we require compensation for their recklessness and negligence?

warmblood• 12 years ago

We've all been waiting for that argument for a while. When are you going to finally reveal it to us?

onedev• 12 years ago

Right, because putting THE ENTIRE NATION AND IT'S CITIZENS at risk EVERY SINGLE DAY is comparable to allowing low level criminals to operate....

Why do we let awful people like this be in charge of our well being? Is power too entrenched that no matter what happens, we can't do anything about it?

adventured• 12 years ago

It would require the assumption that, for example, the NSA knew about it but other foreign authorities - who no doubt attempt to spy on various Americans and US corporations - did not know about it. I don't like those odds.

diydsp• 12 years ago

Their job is not to spy on behalf of the country.

Their job is to keep us safe.

Letting us all run around with humungous holes in our security for years was a risk to our national security. How do you think the Chinese were able to clone our weapons systems so well? Shit like this.

slantedview• 12 years ago

"The NSA's job is to spy on behalf of the country."

Spying on the country and spying on behalf of the country are not really the same thing.

Zigurd3• 12 years ago

I doubt such subtlety entered into the decision. The NSA plays offense, and this was a win from that point of view.

The only way to get a different result is to re-allocate resources away from NSA and build an agency from the ground up that is geared toward securing systems.

john_b3• 12 years ago

I think you missed the part where the NSA claimed it prioritized protecting the data of Americans and American companies. Nobody denies that exploiting the bug would be useful for the NSA.

zacinbusiness5• 12 years ago

Are there any cases where the actions of the NSA are in any way beneficial to US citizens? Can they show that they have ever done anything positive at all? Have they saved a single life? Stopped a single threat? Or are they too busy jerking it to sexting pics and playing WoW (seriously? Come on, guys) to actually do anything useful with the BILLIONS of dollars of money that they get to play with?

sp3324• 12 years ago

Lots of education: Conferences, teacher training, student scholarships. Also, selinux.

mikeash3• 12 years ago

The NSA has done a lot of beneficial things, such as helping design more secure crypto primitives (e.g. strengthening DES against differential cryptanalysis, fixing SHA-0 to produce SHA-1) and helping build secure software (e.g. SE Linux).

I assume what you really mean is whether their dragnet surveillance in particular is ever beneficial to US citizens, and that certainly seems to be a "no".

mpyne5• 12 years ago

Are there any cases where the actions of the NSA are in any way beneficial to US citizens? Can they show that they have ever done anything positive at all?

Yes, and quite easily.

If that's your only testing criteria for whether a government agency is useful then NSA will pass with flying colors.

dfc3• 12 years ago

It is posts like this that make me think twice about reading the comments on NSA stories. For starters how many intelligence agencies publicize their successes? Do you think other four eyes purchase full page ads detailing the highlights of successful intelligence operations?

Anyway lets skip the banal "intelligence agencies failures are public and the successes are private" and get to actual examples:

DES SBoxes

SELinux

NSA Academic Centers of Excellence

VENONA

dombili2• 12 years ago

My first thought: if this is the case, then why did they try so hard (and get "trolled" in the progress) to get the SSL keys from Lavabit?

tptacek10• 12 years ago

Because NSA didn't try to get Lavabit's keys at all; DOJ did. Two very different organizations. Not as incestuously linked as people think they are.

Also, worth mentioning: it's not particularly easy to get private keys out of servers with the bug.

dombili2• 12 years ago

That makes sense, I guess. I'm not American so I don't know much about the inner workings of these institutions.

Is it unlikely for FBI to ask NSA's help?

geetee• 12 years ago

Get the proof via nefarious ways and then construct a "legitimate" way of obtaining the information you already have.

wglb• 12 years ago

As an example from history, see the story about the zimmerman telegram http://en.wikipedia.org/wiki/Zimmermann_Telegram and the british interception and decryption. They faked a theft to hide the fact that they were reading the traffic with the help of Room 40.

freerobby• 12 years ago

Yeah. Whether that happened here or not, I have no idea, but it makes perfect sense if you want to create plausible deniability about what you have the means to accomplish.

ErikAugust• 12 years ago

Legal versus illegal means?

gregd• 12 years ago

Maybe because their plan all along was to shut Lavabit down?

antonius• 12 years ago

Good luck trying to wiggle out of this one, NSA.

err4nt• 12 years ago

Do we have anything that leads us to believe the NSA was aware of heartbleed at all before we found out, other than speculation because of their resources?

masterleep• 12 years ago

Why would you give them the benefit of the doubt? If anything, the base assumption should be the reverse.

tptacek10• 12 years ago

Well, Bloomberg appears to have two sources.

lot49a• 12 years ago

We have "two people familiar with the matter" which is to say sources that Bloomberg thought were credible enough to lead a story with.

danielweber3• 12 years ago

Who is "familiar with the matter"? NSA insiders? People who've read the Snowden docs?

I wonder if Bruce "probability is close to one that every target has had its private keys extracted by multiple intelligence agencies" Schneier is one of them.

mindstab• 12 years ago

Evidence? And if so, pretty much what we expected and exactly why this behaviour is terrible

joshstrange• 12 years ago

> The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said.

(emphasis mine)

It's pretty weak IMHO but I don't really doubt it.

sp3324• 12 years ago

Probability that story is true | Bloomberg reporting it == Probability that the sources are right * Probability that Bloomberg isn't lying about having sources ~= 80%.

The sources could be lying for many reasons. As a prank, to discredit Bloomberg when they report on other NSA stories, because they're embarrassed the NSA didn't know earlier, etc. But Bloomberg knows this and presumably required some evidence to satisfy themselves before reporting. So the deciding factor is really Bloomberg's reliability.

yen223• 12 years ago

I've heard of the NSA, and I've read that xkcd comic on how Heartbleed works. Can I be quoted as a person "familiar with the matter"?

arrrg• 12 years ago

The bug only existed in the wild for two years and less than a month. I’m not sure what the “at least two years” means in that context. The NSA can’t have known this bug for a lot longer and “at least two years” implies to me “at least 24 months and possibly many more”, not “at least 24 months, at most 25”.

mschuster916• 12 years ago

No fucking way. This is disastrous PR stuff, second only to the Snowden revelations.

It should be clear by now that the NSA does not restrict themselves from anything... and should be disbanded.

tptacek10• 12 years ago

I don't know how "disastrous" this really is.

NSA knows approximately 1 zillion vulnerabilities we don't know about and won't know about. They range from RCE's in Windows and Apache to flaws in cryptographic hash functions.

It's NSA's charter to stockpile these things, and, yeah, to use them against foreign adversaries.

It's bad though, because this one was so easily exploitable. It's the kind of thing a reasonable organization finds out about and wants fixed ASAP.

mschuster916• 12 years ago

Eventually, the bad guys will find all of these bugs. And do massive amounts of damage (in this case, potentially billions of people who should change their password, and hundreds of thousands of administrators having to swap certificates).

And all the time, the NSA had the capability and knowledge to prevent this damage. What a great service they did to their country, indeed.

Touche• 12 years ago

It's NSA's charter to stockpile these things, and, yeah, to use them against foreign adversaries.

I don't see how leaving American companies vulnerable fulfills the NSA's charter.

sp3324• 12 years ago

Exactly, I don't mind them having the capability for this kind of thing. What bothers me is the lack of due process and rule of law!

mikeash3• 12 years ago

It is? It would be shocking if the NSA didn't use Heartbleed. This is basically the equivalent of doing a news story about an alcoholic who drinks the beer they have in their refrigerator. It's exactly what you'd expect them to do.

danenania• 12 years ago

I don't know if Heartbleed could reach this point, but I think probably the only possibility for getting average citizens up in arms about this kind of thing is for them to start seeing major personal detrimental effects (like oops, all my email has been stolen and deleted and my bank account's empty), and then learn that the NSA could have easily prevented it if they weren't having so much fun being super-hackers instead.

maxerickson2• 12 years ago

I don't think average people (so to speak) really care about their email.

iscrewyou• 12 years ago

You are very wrong.

ygjb• 12 years ago

They don't until either they lose all of their email, or they lose their email account.

Zigurd3• 12 years ago

Even n00bs understand that if their email gets jacked, that can be used to reset all their other passwords and jack those accounts.

jaydz• 12 years ago

I don't know about that. Yesterday, my sister (a person who has no interest in tech, government, and is downright afraid of both) asked me about Heartbleed and stated it was the topic of discussion during breaks at work. I was pleasantly surprised.

mpyne5• 12 years ago

You know, even my bank has a special warning up about Heartbleed. I also saw it as #1 on BBC News at some point, fed to my Android phone's news, etc. It's a surprisingly big deal.

higherpurpose2• 12 years ago

This is how NSA "protects America" and its infrastructure from "cybercrime" - by allowing a bug like this to exist for years without telling anyone about it.

I hope it's now clear to everyone what NSA's vision about "cybersecurity" is. They think having vulnerabilities like this in the Internet's infrastructure is a good thing, because then they get to attack their "targets", to "protect us". It has nothing to do with actual security. Weakness is strength. Vulnerability is security.

lawnchair_larry• 12 years ago

It's going to be pretty hard to say you're playing "defense" with a straight face after this one.

protomyth5• 12 years ago

I'm wondering if any State Attorney Generals are tech savvy, don't like the current administration, and want some publicity[1] enough to start an investigation? I would imagine a subpoena asking for the financial records of the OpenSSL contributors would be a first step (to find Gov payments). I can see a very scary witch hunt.

1) that part might be a little rhetorical, every AG likes good publicity.

tptacek10• 12 years ago

Presumably, any State Attorney General will have gone to law school, and will thus know that the Federal Government is immune to suits from the states.

protomyth5• 12 years ago

They are not actually immune, states sue the federal government (or at least departments) all the time. Look at the ACA cases for an example. They can also go after the individual people involved as long as they are not serving in the government.

Zigurd3• 12 years ago

Who said anything about suing the USG, unless you are already assuming someone contributing to OpenSSL was hired by the USG in some relevant capacity. I don't see what would shield contributors to OpenSSL from a criminal investigation.

tptacek10• 12 years ago

"Financial records of the OpenSSL contributors"? How extremely silly. Knowing about Heartbleed? Easy to see. Not sharing Heartbleed? Easy to see. Deliberately introducing a vulnerability that every single US adversary could trivially find? Beyond unlikely.

protomyth5• 12 years ago

My personal opinion is that I doubt the NSA introduced it, but if it allowed other countries to exploit US citizens and the NSA knew about it, then that is indefensible behavior.

That being said, it would be a pretty standard tactic for an AG to look at who paid the people who did the work. It is a pattern in a lot of different types of investigations and familiar to an AG. Will they find anything? Doubtful. Will that really matter? Doubtful.

I should at this point say that I am thinking of a scenario that would occur to an AG (the pattern happens a lot). I am not advocating such behavior. It would have a huge chilling effect on public source code of any type and probably generate some seriously evil legislation (certifications or liability insurance). These concerns have never been part of most politicians concerns.

schrodingersCat• 12 years ago

I hesitate to believe that in 2 years time, the agency hasn't found another backdoor to the web. OpenSSL might be patched, but what else is still vulnerable?

molecule• 12 years ago

Bloomberg really puts its bias on display:

The Heartbleed flaw, introduced in early 2012 in a minor adjustment to the OpenSSL protocol, highlights one of the failings of open source software development.

And its discovery and resolution highlights one of the advantages of open-source software development.

pyronite• 12 years ago

And its discovery and resolution highlights one of the advantages of open-source software development.

I wouldn't say that its discovery (two years later) says anything good about open source development.

TallGuyShort• 12 years ago

And I also wouldn't say that the existence of a bug was caused by the license that was used. It's not like me keeping all the code to myself would make me a better programmer.

lafayette• 12 years ago

I might be completely wrong but I don't see much difference between open source and closed source in this case. If I were biased I might say that it might have taken substantially longer to discover such a bug in closed source software but that seems to be as much sensible as saying that open source has less security bugs because more people look at the same code.

In the end software is written by people and people make mistakes. I'm pretty sure there are a lot of software be it open or closed source that had absolutely terrible security bugs. Judging open source as a whole by looking at a single project sounds a little bit like overgeneralization. Also, they are obviously in need of help though, I hear a lot of complaints from people about the OpenSSL code.

taylorbuley2• 12 years ago

This is a Washington-based reporter, meaning he's most likely more policy-oriented than technology-oriented (got his start chasing stories on the Hill, not in Silicon Valley).

It doesn't excuse a misunderstanding of his subject matter, but an accusation of bias is likely an over-analysis.

jodrellblank4• 12 years ago

One of the claimed advantages of open source is to produce higher quality, more secure software.

"As a result, the open source model builds higher-quality, more secure, more easily integrated software. And it does it at a vastly accelerated pace, often at a lower cost." - http://www.redhat.com/about/whoisredhat/opensource.html for example.

As an ideology, comparing this OpenSSL happening to the stated goals of strong proponents open source, it is a complete failure of that ideology.

That it was then fixable is an advantage, but that's a separate thing. It doesn't offset the way a really common error in a change to a really common and important library sat unnoticed for two years ... until a private company paid security researcher found it.

You could argue that the bug was found and fixed and the software is now more secure :: the system works, this is how it works.

But this is not how open source proponents present it as working.

NB. This doesn't mean closed source is better. People don't push closed source as an ideology in the same way at all. But do compare open source to the claims made by open source advocates, as well as comparing it to the ease of fixing and finding bugs in closed source software.

the_af3• 12 years ago

This might seem like a nitpick, but I think you're confusing two distinct camps here: let's call them "Open Source" and "Free Software".

Open Source advocates -- such as Eric S. Raymond -- believe that it is superior on technical grounds, the "many eyes make all bugs shallow" theory. They tend to disregard ideology and instead believe OS is the rational decision of those who want technically better software. In my opinion this is not always true, as Heartbleed shows (but then again who knows how many undisclosed vulnerabilities are there in existing proprietary software! At least now we know about Heartbleed!)

Free Software advocates -- such as Richard Stallman and the FSF -- believe it's a matter of ideology. This has little to do with technical quality. They say "sure, if the software is better that's a plus, but freedom is a matter of principle to us".

I'm not a zealot but I tend to side with the Free Software camp, and I don't see how the OpenSSL fiasco undermines their ideology.

PS: I also take issue with the "paid security researcher" remark. Absolutely nothing in either Free or Open Source excludes paid personnel or private companies from the equation. Hobbyist programmers are not the only ones accepted. I don't understand why you see this as extraordinary.

SilasX• 12 years ago

In fairness, the "public good" nature of an Open Source security library does create an incentive problem that's well known in the literature, and is probably related in some way to the failure here.

You might have seen the story about how it gets $2000 in donations a year, which is supposed to be enough to marshal the expertise to prevent this kind of thing.

https://news.ycombinator.com/item?id=7575210

lauradhamilton• 12 years ago

It certainly seems believable, but do we have anything more concrete to go on than "two people familiar with the matter?" Is that even two people with top-secret clearance at the NSA?

cheald3• 12 years ago

Well, consider what that would look like. Given the way that the US Government has pursued Snowden and other whistleblowers for embarrassing them, if you had privileged information indicating that the government was deliberately leaving nearly all Americans' online information exposed, would you want your name attached to it?

humancontact2• 12 years ago

I think lauradhamilton's point is that "familiar with the matter" is too subjective.

smegel• 12 years ago

highlights one of the failings of open source software development.

Sorry? Paid programmers writing closed code with probably less review and auditing have been shown to create less bugs? What are they trying to say?

ksk• 12 years ago

What data did you use to estimate the probability of code review? Would be interesting to see if anyone has studied this.

leeoniya• 12 years ago

s/Flawed Protocol/Flawed Implementation/

muyuu2• 12 years ago

This is flamebait. Sad it's getting so many upvotes.

ikt• 12 years ago

I agree, in the first 3 paragraphs I shook my head 3 times

"two people familiar with the matter said." <- so you made it up

"threatens to renew the rancorous debate over the role of the government’s top computer experts." <- you made this up as well

"Heartbleed appears to be one of the biggest glitches in the Internet’s history" <- Not even close.

"as many as two-thirds of the world’s websites" <- less than 17% of SSL based webservers, certainly not two-thirds of the entire freakin internet.

"it’s possible that cybercriminals missed the potential in the same way security professionals did, suggested Tal Klein, vice president of marketing at Adallom"

"this article is shite, suggested ikt, junior vice president of Compuglobalhypermeganet"

muyuu2• 12 years ago

The point about it being VERY serious, I can accept. The rest... yep, pure bull. Also "btw Open Source sucks, proprietary good".

The article is rubbish.

jostmey• 12 years ago

The NSA protected us by not disclosing to us a serious security vulnerability in our software. It is hard for me to wrap my brain around reasoning of the intelligence agencies.

john_b3• 12 years ago

To be fair to the NSA, it's not just them. Many other government agencies operate under the assumption that society is better off if people are protected from themselves. It's why we have FCC censorship and the war on drugs. Questioning this core assumption is verboten in these organizations because it is equivalent to questioning their reason for existing. So when they take criticism from the public they naturally retreat to their core assumptions and values, even if they have to dress it up with doublespeak.

spenvo• 12 years ago

Here we observe a side affect of the NSA/GHCQ operating in a manner which always gives offensive capability precedence over the defense of civilian systems.

In case you haven't made the time yet -- ACLU's interview of Snowden at SXSW was excellent and dives into the implications of this: https://www.youtube.com/watch?v=UIhS9aB-qgU

On another (ironic) note this PSA from the US government is about 2 years late: http://www.bbc.com/news/technology-26985818

forgotAgain• 12 years ago

Sounds plausible to me. I would think the NSA, and other spy agencies, pour over every release of a security package to see if any exploitable errors were made.

stcredzero• 12 years ago

Your friends tell you about your flaws and shortcomings. The people who keep quiet or even exploit your flaws? They are not your friends.

So, what's to keep some organization that runs a package repo from publishing OpenSSL packages that claim to be like OpenSSL 1.0.1g but actually display the heartbleed bug? I also ask myself, would the NSA seek to implement such a thing? They would, though that is an entirely different question from if they have.

mschuster916• 12 years ago

This is why you can, on Debian/xbuntu, always run a apt-build from the source and verify the patch is present in the code. Or on Gentoo, it's building from source anyways.

(Or just use Debian in the Gentoo flavour from the beginning)

zacinbusiness5• 12 years ago

While there's no evidence (yet) that the NSA knew about or exploited this bug, I would not be the least bit surprised if they did. Honestly, my first thought when reading about Heartbleed was "I wonder how much the NSA paid the contributor. Or did they just threaten his family?" It seems there have been a lot of "oops" errors being found in critical security systems these days, and every single one of them is directly beneficial to the NSA and its mission to "h4ck the plan37!"

ArtDev• 12 years ago

“It flies in the face of the agency’s comments that defense comes first”

The NSA needs to be dissolved. It is a costly liability whose actions work against the nations interests as a whole.

jrochkind12• 12 years ago

The agency found the Heartbleed glitch shortly after its introduction, according to one of the people familiar with the matter,

Presumably if the anonymous sources here were discovered, they'd be in big criminal trouble, right? I am curious how far the government goes to try and discover them.

And I think there is no way these anonymous sources would have contacted the journalists without Snowden going first, to establish the context and interest. Snowden's actions continue to benefit us all, cascading.

gojomo4• 12 years ago

Not necessarily, this might actually be an approved ass-covering leak.

You may think it's awful that the NSA knew for 2 years, and didn't push fixes... but their funders and overseers, in Congress and the DoD, would be more likely angry if, given the NSA's massive budget and mission, the NSA didn't know about this bug right away via code audit/analysis. Knowing vulnerabilities first is the whole job of the "Cyber Command".

And, the best defense isn't necessarily a panicked fire-drill of preemptive patching ASAP, if you're sure you're the only ones who know. It could make tactical and economic sense to simply prepare contingency plans, and wait for the first evidence of a 2nd-discoverer.

malandrew4• 12 years ago

A possible smoking gun in this case would be to check if most of the NSA's and the DOD systems over which it has oversight were not vulnerable this entire time while the private sector remained vulnerable.

If they truly didn't know about this, you'd expect that a lot of the US government infrastructure has also been vulnerable this entire time.

I've seen the Alexa top 1000 list showing who was vulnerable. I wonder if there is a similar list for the top 1000 computer systems and networks over which the NSA has security oversight.

jrochkind12• 12 years ago

The SSL protocol has a history of security problems, Lewis said, and is not the primary form of protection governments and others use to transmit highly sensitive information.
“I knew hackers who could break it nearly 15 years ago,” Lewis said of the SSL protocol.

Anyone know wtf he's talking about?

cheald3• 12 years ago

TLS has been subject to a lot of attacks:

http://en.wikipedia.org/wiki/Transport_Layer_Security#Attack...

Plus, since the whole thing is based on CAs, if you can get an intermediate cert (and does anything think the NSA can't?) and you have the means to MITM someone, that's as good as breaking it, too.

15 years ago, we were using keys with much lower entropy, as well, which may have simply been outpaced by computing power.

anonbanker2• 12 years ago

Now would be the time to start looking up the backgrounds of the people who implemented heartbeat support. For instance, the same guy responsible for the Heartbeat spec was the author of the OpenSSL implementation.

While we do not want to make this into a witch hunt, now that the NSA is involved in Heartbleed, we should definitely rule out malice by checking for direct ties between contributors of known flawed/malicious code related to the implementation of Heartbeat.

dangero• 12 years ago

100% agree. Here's a related question: How many people do you think the NSA employs to work on open source software and blend into the community, establish credibility, etc. Is the answer zero people? Given what we know about the NSA now, zero seems unlikely.

malandrew4• 12 years ago

We absolutely do not want this. We rely on the goodwill of a lot of really smart people to produce the open source security software we rely. Even if the person who introduced this bug did in fact conspire with the NSA, we would do far more damage by going on a witch hunt. The majority of people working on this software are well-intentioned and if contributing to open source means that they risk being subject to a witch hunt for their contributions they will be far less likely to partake.

The only reasonable course of action is to apply oversight of the NSA. If people in open-source are moles, the only reasonable way to discover this is via oversight of the agency. If there are moles, there are records within the agency showing this to be the case. Getting ahold of those records is how you prove this and you get those records by getting congress to do their job and provide oversight.

anonbanker2• 12 years ago

Sounds like an great plan. Perhaps you could provide an example from history where your idea works? I'm having difficulty finding one.

ChrisLTD• 12 years ago

The US government seems intent on destroying the viability of the Internet as a commerce platform.

humancontact2• 12 years ago

two people familiar with the matter said

As much as Snowden has shown us the amount of effort NSA puts into this kind of stuff, I think we need more evidence than this article is giving.

bhousel• 12 years ago

Whether it's true or not, I think the correct thing for the NSA to do would be to say that they knew about it for years and exploited it. That is their job, after all.

mpyne5• 12 years ago

NSA has two jobs:

1. Gain signals intelligence on specified foreign targets. 2. Protect U.S. signals from having the same done to the U.S. by other states.

The second responsibility is why there are things like SELinux, NSA "Suite B" cryptography, etc. It has also led to security bugfixes to open source code (such as X.org) used by NSA or within government.

The reason that both duties are held in NSA is because the best way to defend against the best SIGINT hackers in the world is to have the expertise of the best SIGINT hackers in the world. It's why NFL teams have their offense practice against their own defense and vice versa.

In this case the flaw is so completely egregious (and relatively easy to spot for other states' spy agencies reviewing commit diffs) that the duty of NSA would quite clearly to have been to get OpenSSL fixed, if only because so much government IT could be affected by this.

The bug was introduced pre-Snowden as well, so it's not like NSA didn't have other cyber weapons to use to achieve the effects they need. So if it's true that NSA knew about the bug and let it remain open to protect "methods and sources" then they definitely chose wrong and someone needs to explain how they came to that choice...

higherpurpose2• 12 years ago

Well this was flagged fast.

dsugarman• 12 years ago

What upsets me the most is that they new this existed, and that a lot of the US economy relies on our tech companies, and they did nothing to inform the companies about the security flaw.

mcculley• 12 years ago

This is according to "two people familiar with the matter". While nobody would be surprised that the NSA had exploited heartbleed, this article gives no compelling proof.

I wish newspaper articles had a bit of metadata that indicated whether the sources are verifiable. Then we wouldn't have to waste any time reading them when they aren't.

thefreeman• 12 years ago

So is there a single shred of evidence besides something unquoted by `two people familiar with the matter said`

because if not this is just straight up link bait.

taylorbuley2• 12 years ago

The NSA is denying this report.

Statement: NSA was not aware of the recently identified Heartbleed vulnerability until it was made public.

https://twitter.com/NSA_PAO/status/454720059156754434

ceejayoz• 12 years ago

Full statement: http://twitter.com/ajamlive/status/454724369429045248/photo/...

The NSA has a good history recently of lying through their teeth, and the bit at the end "Unless there is a clear national security or law enforcement need..." is a pretty damned large asterisk.

abdullahkhalids• 12 years ago

You can assume that any bug in open source software that could have been found using systematic and automated analysis has already been found by the NSA.

otterley• 12 years ago

I've never understood theories about NSA capability. Everyone complains that Government officials are barely competent, if at all, yet when it comes to NSA, those same people think NSA staff is at least ten times as brilliant as the general population.

Everything I've seen NSA do is largely based on the same techniques Google uses, except 10 years later, much more expensively, and with much uglier PowerPoint presentations. The only thing NSA has that private organizations don't is the compelled cooperation of telecom companies.

devindotcom• 12 years ago

FWIW, we asked the NSA and NSC; both deny:

http://www.nbcnews.com/tech/security/nsa-denies-it-used-hear...

JackC• 12 years ago

I've been seeing a lot of comments recently along the lines that we "need" more evidence before we assume that the NSA took advantage of heartbleed. I don't get that at all.

I'd love to have harder evidence of what the NSA has been up to. I get that. But here are some things we know: the NSA believes its mission is to collect 100% of the world's data, with the possible exception of data that definitely belongs to US citizens. The NSA has boasted internally of cracking SSL implementations as part of its work. The NSA employs more people who are qualified for and tasked with finding this kind of exploit than anyone else. The NSA's leadership is willing to lie under oath to Congress -- let alone to anyone else -- about its activities. The NSA's secrets are about as heavily defended as secrets can be -- actually providing the kind of evidence requested here is widely considered treason against the United States. And now an investigative reporter with a serious reputation says that he has two sources who can confirm that the NSA knew about heartbleed shortly after it was created.

So let's assume you might behave differently in some way -- in any way -- if the NSA knew about and exploited heartbleed. You have imperfect information and you have to make a call. What else could you "need" before you decide to behave as though this article is accurate?

I think we "need" to assume that the NSA took advantage of heartbleed starting shortly after it was introduced. We'd just "like" to have a little more confirmation about what the hell they've been up to.

tzs• 12 years ago

The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug [...]

Interesting that they say "at least" two years. The bug is two years old, so they could have also chosen to say "at most" two years or "up to" two years. Least biased would be to just say "since the bug was introduced, two years ago".

malandrew4• 12 years ago

A reasonable policy upon discovering this type of bug is to allow the agency a fix period of time to exploit the bug and then require that they provide support in fixing the bugs for as many major US companies and institutions as possible as quickly as possible.

If they are given carte blanche to use the exploit indefinitely, they will keep it forever and let the world discover and exploit it as well. If they have a finite time period like 1-3 months, they will prioritize exploiting those systems that are actually valuable for national security. While they are doing so, they should keep an auditable log of all the systems they use the exploit against so that oversight may be performed in hindsight. Furthermore, they should absolutely be barred from using any exploit against a target with a US-based IP, or possibly even any IP address in allied nations.

It is far less likely that the agency will have the opportunity to abuse exploits if they are forced to prioritize targets due to a fixed deadline on disclosure.

During the deadline period, they should also be working on a plan that minimizes the amount of damages once disclosure is forced. i.e. there should be a list of people and companies that get the information first and everyone on the list should be people in charge of protecting computer systems (i.e. no one involved in offensive activities is on the list). Companies like Google, Facebook, Akamai, Apple and the package maintainers for all the major *nix distros should be on that shortlist of those that get priority notification.

NSA Said to Exploit Heartbleed Bug for Intelligence for Years

Related Stories