NSA Knew About And 'Exploited' Heartbleed For Years: Bloomberg

[WillyT]

NSA Knew About And 'Exploited' Heartbleed For Years: Bloomberg
The Huffington Post | by Dino Grandoni
Posted: 04/11/2014 3:10 pm EDT Updated: 04/11/2014 5:59 pm EDT

<snip>

The Heartbleed bug just went from bad to worse to truly, utterly terrifying.

The National Security Agency knew of the existence of the catastrophic bug for at least two years and kept it a secret from the public and the cybersecurity community in order to exploit it, according to a bombshell report from Bloomberg News. However, the agency is denying the story.

While it's unclear what the agency was able to do with its knowledge of the exploit, we at least know this: If the report is true, the NSA knew about one of the most dangerous bugs in Internet history, and it did nothing to warn us about it.

"NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private sector cybersecurity report," the Office of the Director of National Intelligence said in a statement to HuffPost. "Reports that say otherwise are wrong." A White House spokesperson also stated that no federal agency was aware of the bug.

First discovered by Google and Codenomicon, a security firm, the Heartbleed bug is a flaw in the encryption used to protect vast number of websites from hackers. The fear is that the bug may expose credit card numbers, passwords and more.

Yahoo, Amazon and many, many other major websites used the free code, called OpenSSL, since encryption software is notoriously difficult to write.

Immediately after news of Heartbleed broke, some suspected that the NSA was exploiting the security lapse to access people's private data. Others saw it coming even before that: The documents leaked by former NSA contractor Edward Snowden indicated that the NSA partnered its British spying equivalent, the GCHQ, to try to crack SSL and other encryption standards that protect the Internet.

<snip>

More: http://www.huffingtonpost.com/2014/04/11/nsa-heartbleed_n_5134813.html

[grasswire]

1. just meta data, doncha know?

Where are the apologists?

All at happy hour?

[WillyT]

2. 2 For 1 Special, I Suppose...

[MisterP]

13. we're not being spied on! because the One said so!

http://en.wikipedia.org/wiki/Fideism
boxes and ballerinas and ChiCom spymasters and high-speed rail

[BlindTiresias]

3. More info

http://www.techdirt.com/articles/20140410/12594026871/big-question-when-did-nsa-know-about-heartbleed.shtml

[Mojorabbit]

4. k and r nt

[RobertEarl]

5. They did not write the code

So stop saying that. They would not break laws. Everyone spied on deserves it. It is so written right there in the law.

How's my imitation doing?

[WillyT]

7. Sorry...

What was I thinking.

[idendoit]

6. According to the Bloomberg artilce...

..."two people familiar with the matter said". Well, it's just gotta be true then. This is all pure speculation.

[MindMover]

8. Prove it is false, because so far the only thing we have is a denial from NSA ... nt

[idendoit]

9. I'm not the one making the assertion.

Tell the posters and Bloomberg, for that matter, to prove their speculation. Is two unidentified people saying so enough to make you believe?

[MindMover]

10. People in the know, YES ....

and for the NSAer out there looking at this ....

I do not watch porn on the net nor am I convicted of any crime other than speeding tickets ....

[idendoit]

12. Try to emulate your avatar and not worry so much.

[PosterChild]

23. I know, for a FACT, that the NSA was not behind it....

... it was sloppy coding, a bug. If the NSA had done it, they would have done it right.

[Pholus]

11. That's EARNED trust.

Anyone impartially weighing statements has no choice but to rank statements made by two anonymous people familiar with the matter over public statements from the organization run by General "Least Untruthful Manner" Clapper.

[idendoit]

14. Only two choices?

How can you be sure that 'two people familiar with the matter' aren't the reporter and their spouse? Are you saying the entire federal government is operating outside the law?

“Those of us who support the call records program do so with a sincere belief that it, along with other programs, is constitutional and helps keep the country safe from attack. I believe the program can benefit from additional transparency and privacy protections—including additional public reporting and added court review provisions which were recently adopted by the Senate Intelligence Committee in the bipartisan FISA Improvements Act.” ~ Senator Feinsten.

Under Section 215 of the US Patriot Act, Congress and the President, (secretly) tasked the NSA with what it is now legally doing. Congress has oversight. The Supreme Court turned down an EFF suit hearing, the matter is now on hold pending an appeal by the DOJ. This section is due to expire June 1, 2015. Will Congress renew the law? Will the President renew his support? Odds are, I think it's safe to say, all branches will say again: It's the Law.

[Pholus]

15. Yup, the two people are questionable.

Compare that with the leadership of the NSA. They're certainly NOT questionable since they have already established that they will not tell the truth, nor do they feel the need to.

[PosterChild]

22. +100 !!!

[Oilwellian]

16. Wow, I feel so much safer...Thanks NSA!

Last edited Sat Apr 12, 2014, 05:13 PM - Edit history (1)

You knew Americans were vulnerable to this bug and instead of protecting us from an international consortium of hackers and criminals, you decided to join them! Bravo! Simply Bravo!

[JDPriestly]

17. K&R.

[pragmatic_dem]

18. NSA steals our property and NSA apologists enable them. There is

no difference between the NSA apologist and global warming denier.

No difference between the NSA apologist and the people suppressing voting rights.

No difference between the NSA apologist and the people calling Wall Street CEOs "job creators".

No difference between the NSA apologist and the people calling torture "enhanced interrogation".

They all have one thing in common - protecting the 1% behind gated communities while hundreds of millions of us watch our incomes drop, opportunities fade, environment degrade and civil protections get trashed.

"It's all for our own good".

No, it isn't.

It's all for their own good.

[mia]

19. So everyone will know everything about each and every one of us.

Who cares.
So much fear and terror about nothing in the scheme of things.
It's time to reveal more about the real villains who suck the breath out of all humanity.

[pragmatic_dem]

20. who cares? here is who cares

1. the reporter documenting government corruption and wrongdoing

2. the political challenger facing an opponent with power ties to government

3. the whistle blower exposing government corruption

4. the ordinary person planning to protest keystone xl pipeline

5. the religious extremist in government targeting abortion rights activists

6. someone being blackmailed to give information

That's for starters.

If you don't have anything to protect, that means you have nothing to lose, including democracy.

I feel very sorry for you.

[dreamnightwind]

21. Only those looking to control or imprison others

will know everything about everyone. The rest of us will be kept in line with the threat of embarrassing or incriminating information.

If this somehow resulted in us knowing all of the dirt and activities of the oligarchs and their minions, it might, as you suggest, be worth the loss of our privacy. Somehow I don't see it spinning out that way. We'll never know their activities, but they will know ours.

[n2doc]

24. Every day, and in every way, I feel Safer and Safer! n/t

[Blue_Tires]

25. I'd have thought the NSA would only be one of dozens of organizations to have taken advantage

Of course, now that the NSA has been mentioned with the story, everyone else is going to get a pass...

But ultimately I'll wait and see if any solid sources can corroborate this on the record...

[DeSwiss]

26. K&R

“To see what is in front of one’s nose needs a constant struggle.” ~George Orwell