Statement on Bloomberg News story that NSA knew about the “Heartbleed bug”

http://icontherecord.tumblr.com/post/82416436703/statement-on-bloomberg-news-story-that-nsa-knew

by rinon • 12 years ago

138 114 12 years ago

icontherecord.tumblr.com

wrs• 12 years ago

The third paragraph flatly says it is in the national interest to disclose zero-days.

The fourth paragraph says there is a "reinvigorated" process for deciding whether it is or not.

Obviously the fourth paragraph is more correct -- is the third paragraph just there for an easy inaccurate quote?

cyphunk4• 12 years ago

If the statement is true or not doesn't matter because this gem screams bullshit:

    it is in the national interest to responsibly disclose 
    the vulnerability rather than to hold it for an
    investigative or intelligence purpose.

Or to read that differently "The intelligence community would disclose 0days rather than use them as weapons".

mpyne9• 12 years ago

It's reads pretty obviously IMHO.

"Any 0day has an obvious national security interest in being responsibly disclosed and fixed".

That's not a very direct affirmation though, merely an "interest"... the caveats show up at the end, but even that is at least honest.

You'd be crazy if you thought NSA would disclose a server 0day that e.g. affects only websites running under a Russian locale, when those websites are known to be used by the Russian armed forces bordering Ukraine. That's the type of thing which could be useful to NSA while having practically nil effect on U.S. infrastructure.

cyphunk4• 12 years ago

I would agree with you except that they added the "rather than". It is a debate between the 0days value as a weapon through holding secret vs value of release to everyone else. If there was any merit to them holding any bias toward the latter we would see at least ONE public disclosure of a vulnerability by them.

d1str0• 12 years ago

Letting a bug/vuln this broad go unpatched for years for the NSA's own benefit is beyond negligent concerning our nation's security.

dllthomas9• 12 years ago

Practically treasonous. As they say, lots of important things protected by OpenSSL, and if the NSA did know about it two years ago, when did similar organizations in other governments spot it?

anonbanker• 12 years ago

Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities.

wow, those two caveats are broad enough to remove any real meaning from the process.

Zigurd• 12 years ago

The cool part is that you can actually measure how weasely are those weasel words: As other security experts have pointed out here, the NSA's hoard of zero-days is numbers in the thousands. How many times have they practiced "responsible disclosure?"

nraynaud• 12 years ago

Oh so now the NSA publicly comments on allegations about its operations?

rinon• 12 years ago

Now who do we believe... an anonymous source or an official press release (from an agency with both motivation to lie and a history of misleading statements). Both seem fairly unsubstantiated to me.

kposehn• 12 years ago

While the ambiguity in later paragraphs is par for the course, the directness of the initial statement is refreshing.

mpyne9• 12 years ago

"The Federal government relies on OpenSSL to protect the privacy of users of government websites and other online services."

This is my big point from the other thread. If NSA knew then not disclosing this type of serious bug should get someone's head to roll as it could imperil the security of other important USG communications.

That still leaves open the question of why NSA wasn't able to find this bug themselves though -- you'd think they'd be looking for bugs related to the introduction of new features into OpenSSL.

higherpurpose2• 12 years ago

That's such a weak argument from them at this point. "Hey, we're the NSA - we're entrusted to protect US infrastructure. We'd never do something like that!"

Yeah, right.

"Oh, and we're under strict oversight, too!".

hadoukenio3• 12 years ago

Has this actually verified? It was only newish versions of OpenSSL that were vulnerable. Websites that ran on IIS and other platforms were not vulnerable.

Does anyone have a historical list of critical government websites and their web server versions? An old nmap list would suffice to show that high-priority sites were vulnerable or not.

mpyne9• 12 years ago

Many parts of government run Linux, including NSA themselves, other military platforms, and advanced research/development labs. Certainly there's tons of MS, but govvy is just so big that even OpenSSL being rare would still be highly concerning for USG security.

patrickg_zill2• 12 years ago

Just keep in mind that the NSA routinely lies... even in direct testimony under oath to Congress.

http://www.slate.com/articles/news_and_politics/war_stories/...

malloreon• 12 years ago

we need to begin putting government officials in prison for this.

Cthulhu_• 12 years ago

Pretty sure the laws / etc in place right now make sure no individuals can be held responsible for that kinda thing; do (former) presidents get charged with mass murder for wars in Iraq / Afghanistan, for example? Government is different from common sense of law and right and wrong.

baddox2• 12 years ago

Unfortunately that "we" is the government officials themselves.

patrickg_zill2• 12 years ago

I agree! I don't think anything will change until doing such crimes results in jail.

mpyne9• 12 years ago

Either way Clapper would be breaking the law. In this case was placed between the choice of breaking his SF-182 NDA (which actually does have criminal implications... just ask Snowden) or lying to Congress in response to a question that the Congressman asking knew the answer to, but didn't want to take the risk of putting into the record himself.

An interesting take on the matter is at http://joelbrenner.com/clapper-and-wyden-scenes-from-a-sandb...

dllthomas9• 12 years ago

The questions were pre-approved. He could have objected to it beforehand, in private.

niels_olson• 12 years ago

I don't think I have ever upvoted so many comments in one HN thread. The NSA earned every ounce of distrust that is currently being pointed at them. I just wish people were investing as much time in OpenSSL as they are in discounting NSA statements.

hadoukenio3• 12 years ago

Lol. I was thinking the same thing. Almost all current comments in this thread have value.

gojomo2• 12 years ago

What if they have a unique definition of 'vulnerability', much like they had a unique definition of 'collect'?

As a bit of internal jargon, the NSA only considered information 'collected' when an analyst looked at it. So, they could record & store bulk data about all Americans, but still claim (with a secret wink) that they didn't intentionally "collect" data on Americans.

Maybe for them, 'vulnerability' means both "the bug exists" and "bad guys know enough to exploit it". After all, if a tree falls in the woods, and there's no one there to hear it, does it make a sound?

This definition even makes sense, if you have an advanced, economic and strategic understanding of security as something that's a matter of relative priorities and dynamically-changing situations. There are plenty of bugs, known and unknown, in all software. Perhaps they only count as 'vulnerabilities' when they're practically exploitable, and practical exploitation has as an absolute prerequisite, discovery by malicious actors. (On the other hand, when we, "the good guys", discover the bug, it's not a vulnerability: it's an asset! Search for [NOBUS NSA] for more reporting about this style of reasoning.)

Still, using such a fine-grained bit of internal jargon, even if it makes sense among people who share your terms, is deceptive if used to hoodwink the public and Congress, exactly as the 'collect' finesse definition was long used.

lkd• 12 years ago

Or they straight out lied.

Wouldn't be the first time.

krick2• 12 years ago

Or they didn't.

See, now we have complete set of possible answers! So, what does it means when NSA officially announces something? I'd say, it means nothing.

bjornsing• 12 years ago

Or they just didn't know. Seriously, if you divide the world into the NDA and the non-NSA, then why would the former be much better than the latter at finding vulnerabilities in open source software?

logn• 12 years ago

NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private sector cybersecurity report

Or perhaps the "private sector cybersecurity report" was a IRC chat two years ago for l33t haxors.

tgb• 12 years ago

They went on to: "Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before April 2014 are wrong." so there's no weasel-wording going on here.

higherpurpose2• 12 years ago

Maybe they are just being "least untruthful".

homulilly3• 12 years ago

The NSA doesn't need to redefine "Vulnerability" or use any other jargon. When it comes to issues the government considers related to national security, they don't bother to hide behind convoluted language or misleading information, the NSA has already demonstrated it's willing to flat out lie to the public regarding such matters.

SwellJoe• 12 years ago

Last sentence reads: "Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities."

So, should the NSA decide that there is a national security interest or law enforcement need, they will not disclose such vulnerabilities. Given their past behavior and explanations for what was considered acceptable compromise for national security, I am not particularly reassured by this statement.

Yes, it's good that they weren't hoarding this particular exploit. But, they have clearly not denied being in possession of other exploits; they've only said that the ones they might hold would be because of national security or law enforcement need.

fredgrott• 12 years ago

the problem is that they will always claim a need

ipsin• 12 years ago

Their statement would carry much more weight if they could point to one example of an exploitable zero-day they've actually disclosed.

I don't particularly trust the NSA, but this example probably exists.

eliteraspberrie• 12 years ago

With regard to the Linux kernel, for example, their policy was to not look for vulnerabilities and only contribute features:

Did you try to fix any vulnerabilities?

No, we did not look for or find any vulnerabilities in the course of our work. We only changed enough to add our new mechanisms.

http://www.nsa.gov/research/selinux/faqs.shtml#I16

ntaylor• 12 years ago

I suppose "need" is synonymous with "desire" or "usefulness".

malandrew• 12 years ago

It's unfortunate that they have chosen an interpretation base on any current or future need. That wildcard approach means that pretty much everything qualifies.

The law should restrict things to "any current specific known need". Need should be singular and said need must be related to a specific issue or case already under investigation or surveillance. Any language more loose than that leaves open far too much room for interpretation.

They should literally maintain a list of targets they want to infiltrate and that list of targets needs to be open to being audited at some point in the future shortly after the related mission for a target is complete. They should not be allow to apply the vulnerability to any new target identified after the date upon which vulnerability was discovered. These countermeasures would go a long way to prevent abuse since they can't now look at it as a weapon in their arsenal to exploit as they see fit for any future mission.

mikeash• 12 years ago

They would say this if it were true and they would say this if it were false. Total information content: zero.

cyphunk4• 12 years ago

In other news, NSA thinks responsible disclosure is the way to go but apparently has no 0days to responsibly disclose. I didn't know TAO sucked so hard. Can't see how any one will buy this.

hadoukenio3• 12 years ago

"NSA thinks responsible disclosure is the way to go but apparently has no 0days to responsibly disclose".

Very nice! In just one sentence you have completely discredited the ODNI release.

w_t_payne• 12 years ago

I was actually inclined to give them the benefit of the doubt, but your point actually sort of makes sense. I don't like this feeling of not knowing where the boundary between wacko conspiracy theory and ... y'know ... real life ... begins and ends.

fnordfnordfnord• 12 years ago

If they're not lying, that's arguably worse!

ForHackernews• 12 years ago

Is it possible that they've quietly disclosed to affected organizations/teams, but that those organizations don't want to publicly credit the NSA as their source?

cyphunk4• 12 years ago

Likely not. For the past year direct disclosure would be a god send for the NSA and US Gov's reputation. So I doubt it.

aunty_helen• 12 years ago

Sorry US GOV but the piggy bank of trust is currently sitting empty.

This statement isn't worth the memory it's stored in.

staunch2• 12 years ago

It does seem like a judgement call is unavoidable. If they discover exploits that are extremely difficult to use, and extremely unlikely to have been discovered by others, it might make sense to use them. But it also seems clear that they should have an obligation to find and make public exploits similar in nature to Heartbleed. Sitting on a bug like this should be a criminal offense.

geophile• 12 years ago

Use the bug for what purpose? The NSA constantly lies, and also just spies on non-terrorist organizations because terrorism: http://techcrunch.com/2014/04/08/snowden-council-of-europe-t.... They are so beyond deserving the benefit of any doubt.

staunch2• 12 years ago

For spying. No one, least of all Snowden, is calling for an end to the NSA's spying days.

disbelief• 12 years ago

Is this even a legit website? The NSA makes announcements via their Tumblr now? Doesn't that strike anyone else as strange?

a3n• 12 years ago

If this is "legit," then it's one of the weirdest things ever. I can't see why any official statement wouldn't be under a .gov.

gregschlom• 12 years ago

No doubt this is part of their PR strategy. "Look, we use Tumblr just like you. We don't have any fancy blogging platform. In fact, we don't have any fancy tool at all. All we do is boring administrative work."

georgefox2• 12 years ago

It appears the answer to the first question is yes: http://www.odni.gov/index.php/carousel-items/916-the-intelli...

As for the second question, yes, it does seem strange.

meowface• 12 years ago

Aren't the utilization of the 0-day exploits in Stuxnet proof that DoD and the intelligence community generally don't care about responsible disclosure? I'm sure Microsoft would've liked to know about those. I'm also pretty sure many US government systems were vulnerable to many of the exploits, including the MOF file one.

I suppose the NSA counts that as "a clear national security or law enforcement need."

cybernoodles• 12 years ago

Nothing says official like Tumblr.

corywatilo• 12 years ago

TL;DR: We've already got your data from other sources so we didn't need to get it via Heartbleed.

btown2• 12 years ago

"If the Federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL."

I see numerous disclosures from technology companies, security researchers in industry and academia... but for the life of me, I can't recount an instance in which a disclosure came from intelligence-community researchers. Is there any historical evidence of disclosures from the NSA to the open-source community?

ctrl_freak• 12 years ago

Is there any historical evidence of disclosures from the NSA to the open-source community?

I would suspect that NSA would want to conceal the fact that the disclosure came from them.

mpyne9• 12 years ago

Depends on whether things like this are a security disclosure or not (seems not to me, but I'm not a vuln developer): http://lists.x.org/archives/xorg-devel/2010-August/012207.ht...

I don't know of better examples though.

btown2• 12 years ago

I'm also not a vuln developer, but this looks like someone else reported it, and an NSA-affiliated researcher created the patch to fix it.

kaffeinecoma• 12 years ago

Sincere question: is the NSA on record for having responsibly disclosed any previous security holes? Is there some track record of them having actively help close security holes in software?

lxwang• 12 years ago

The most famous example is the DES S-boxes, where the NSA made a change that nobody else understood - until years later, when it was discovered that they had made the algorithm more secure against cryptanalysis techniques that had just been "discovered", but which had evidently been known to NSA long before.

gizmo686• 12 years ago

To expand on the DES example, the S-boxes are essentially large 'random' lookup tables. The NSA took the S-boxes, and replaced them with their own tables. At the time, it was not clear if this was to protect against an unknown attack, or to introduce an unknown attack (which may involve knowing some secret key used to generate the S-boxes).

sukuriant• 12 years ago

Yes, they helped improve DES

http://arstechnica.com/security/2013/09/the-nsas-work-to-mak...

mpyne9• 12 years ago

The -1 in SHA-1 isn't because it was first. It was meant to be just "SHA", but NSA discovered a flaw in their own standardized hash algorithm soon after they published it and issued SHA-1 as a fixed version.

joncooper2• 12 years ago

Are we sure this isn't a parody?

georgefox2• 12 years ago

http://www.odni.gov/index.php/carousel-items/916-the-intelli...

joncooper2• 12 years ago

You just can't make this sh*t up: the "No Fear Act".

diminoten• 12 years ago

If this is true, and the NSA knew about the Heartbleed vulnerability, then how come the EFF hasn't been getting more log data showing the vulnerability being exploited against sites?

How come, so far, only one person has thus far come forward with ANY evidence that might demonstrate a knowledge of this bug before it was discovered?

I just find it depressing how ready the media is to jump on the NSA for things they may not have done. There's plenty to work with in the realm of things they did do, why draw conclusions before there's evidence? So far I've yet to see a static analysis tool that would have caught this, and I don't have any reason to believe the NSA is hand-searching code for vulnerabilities.

smtddr• 12 years ago

>If this is true, and the NSA knew about the Heartbleed vulnerability, then how come the EFF hasn't been getting more log data showing the vulnerability being exploited against sites?

So, I have no idea if the NSA knew about this before or not but your typically configured webserver won't store these in access.log. Also, all the network stuff in between typically won't log SSL traffic(since it's just binary blobs without the private key)

krick2• 12 years ago

I just find it depressing how ready the media is to jump on the NSA for things they may not have done.

I don't like journalism and such, but I think it's OK in this case and I don't find it a bit depressing, maybe even otherwise. Why? Because we should be aware. Always. There's no sense in blaming NSA for something. It's stupid to blame spies for spying. There's no sense in saying something they do is immoral, because it couldn't stop them from doing it. So if you care about them doing something wrong the only way to stop it is to make it impossible. If you don't want NSA to know some data that belong to you — you are enemies, because NSA wants to know anything. And it's OK. It's what they are for.

You obviously cannot prevent what already happened, you can only try to fix the consequences and be more careful in the future. So it's always sensible to assume NSA knew about any single security bug discovered for a long time. And nobody can possibly know if something is true about NSA's knowledge (maybe even not NSA themselves). So even if it's not true — spreading rumors about it is completely fine I guess.

ceejayoz• 12 years ago

If this is true, and the NSA knew about the Heartbleed vulnerability, then how come the EFF hasn't been getting more log data showing the vulnerability being exploited against sites?

I don't know how common the "extensive TLS-layer traffic logs" the EFF is soliciting are. I know I don't collect these.

I'd imagine the NSA would use such things fairly sparingly so as to not blunt their swords. Using it willy-nilly increases the chances of someone going "huh, that's odd traffic" and discovering it.

mixologic• 12 years ago

I sure hope Mr. Snowden has evidence to the contrary.

goatburger• 12 years ago

I don't think we really need Ed's disclosures to tell us anything they say is utter bullshit.

dllthomas9• 12 years ago

But it's so much more gratifying when we have them.

lawnchair_larry• 12 years ago

First, tumblr? Really?

Second:

"When Federal agencies discover a new vulnerability in commercial and open source software – a so-called “Zero day” vulnerability because the developers of the vulnerable software have had zero days to fix it – it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose."

This is demonstrably false. That's not even a point of debate, by their own admission.

The whole statement is worthless.

georgemcbay• 12 years ago

"First, tumblr? Really?"

That was my first reaction too. I'm probably late to the party on this, but when I saw the tumblr domain I thought it was some kind of satire at first.

dllthomas9• 12 years ago

Likewise. I'm still not 99% sure...

hackinthebochs• 12 years ago

I haven't seen this mentined in this thread yet, so I just want to remind everyone of the Suxnet virus that contained four 0day vulnerabilities and was in active deployment from anywhere between two to five years. If you believe that they were the originators of this virus then this directly contradicts the claim that 0days are responsibly disclosed in a timely manner.

bredren• 12 years ago

That the Bloomberg report resulted in a denial so quickly demonstrates the defensive position of US intelligence services today.

Strong suspicion that the a federal agency would withhold vital info about Heartbleed is a direct result of the shocking revelations of mass-surveillance.

I believe the sentiment expressed around this issue is not entirely contained to Heartbleed.

This is about distrust of the federal government to make good administrative decisions around highly technical issues that affect the public. Keep in mind Kathleen Sebelius just resigned largely due to optics around IT management failures.

Widespread distrust of federal organizations ability to manage technology appropriately will only erode faith in federal government as a whole. That's not a good problem to have.

caligarn• 12 years ago

Plot twist, the NSA is sending all the data it has "collected" to aliens living on Mars via the Mars Rover. Now it all makes sense.

downandout• 12 years ago

I find it a stretch to believe that some part of the NSA didn't know about, and/or have a hand in introducing, Heartbleed. There has to be an NSA team dedicated to both causing and exploiting issues with very popular open source software. If there isn't, the NSA isn't living up to its reputation.

The reality is that we'll never get the truth out of them, and it doesn't matter anyway because nothing they say can be believed. They might as well never say anything. Assume that they have intercepted all of your traffic and have dumps of your RAM, and act accordingly.

bigiain• 12 years ago

"The reality is that we'll never get the truth out of them, and it doesn't matter anyway because nothing they say can be believed."

This is clearly now true for many of us.

I wonder how true it's becoming for the people to whom the NSA provide their information? When Clapper happily uses phrases like "the least possible untruthful answer" when explaining to congress why he said "No" when the answer was "Yes", I can't help but wonder if the FBI/CIA/Pentagon/President/B-613 are starting to question/disbelieve every word that comes out of the NSA?

tbolse• 12 years ago

The press is all over this topic, but as usual doesn't do its research well enough. Some insight: the bug was submitted in December 2011 and was only present in OpenSSL 1.0.1 - not in previous releases. 1.0.1 was released on 14th of March 2012. It usually takes a long time until this new versions get largely adopted into other software. Even today 1.0.1 isn't used everywhere. That leads me to doubt that the agencies could have used this vulnerability for a very long time. A year seams reasonable, years rather not. It's very sad thou, that they choose not to contribute to secure software and rather exploit the vulnerability.

brianmwaters_hn• 12 years ago

Why is there a scarcity of comments here questioning the Bloomberg article? For that matter, why was there a scarcity of discussion questioning Reuters' December '13 article about RSA and Dual EC? Neither provided any evidence for their claims, and I presume that, in both cases, the information was obtained from anonymous sources who could not provide documentation a' la Snowden.

homulilly3• 12 years ago

The NSA has already proven that its willing to lie to the public, not just omit information or mislead, when its talking about something the agency considers related to National security. Of course it's still possible they could be telling the truth in this instance, and Bloomberg could have failed to properly vet its sources. However, taking the recent past into account I think most people would agree it is far more likely that Bloomberg is providing accurate information and the NSA is not.

smoyer• 12 years ago

Well ... that's disappointing!

As a top-notch surveillance organization in a top-notch surveillance state, I've come to expect more from the NSA. If their job is to protect my wimpy life from those rowdy terrorists, they should be at the forefront of all hacking activities and it's really disconcerting that they didn't introduce the bug into the code in the first place. A vulnerability that big deserves a big brother to protect it.

On a more serious note, the NSA is segmented and unaccountable ... I doubt anyone including the director can make a blanket statement guaranteeing that it has or has not done something. In the next installment of the NSA saga, a reporter with access to the Snowden documents will find proof that this is a lie.

us0r• 12 years ago

"it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose."

Like all of the exploits used in their "FOXACID" program?

Statement on Bloomberg News story that NSA knew about the “Heartbleed bug”

Related Stories