Two sources familiar with the matter told Bloomberg that NSA staff picked up on the fatal flaw shortly after the code was published, and added it into the agency's box of hacking tricks. One source said Heartbleed was used regularly for years, and that the agency decided not to warn US citizens and companies that their data was at risk.
One of the NSA's specific roles is to safeguard national communications and online security infrastructure; indeed, the agency states as much on its website. "We will protect national security interests by adhering to the highest standards of behavior," they write.
This appears to have been lacking if Friday's report is correct.
"It flies in the face of the agency's comments that defense comes first," said Jason Healey, director of the cyber statecraft initiative at the Atlantic Council and a former Air Force cyber officer. "They are going to be completely shredded by the computer security community for this."
News of the Heartbleed bug surfaced on April 7, and since then the biggest names in the technology industry have been scrambling to patch up their software and fix the flaw. Hackers have already started attacks using the vulnerability, and the internet has probably seen more password changes in the last week than at any point in its history.
Most websites have now upgraded to OpenSSL 1.0.1g, which fixes the problem, but the flaw will also affect software on PCs, phones, and tablets, according to the computer security folks at the SANS Institute. The open source community has been criticized for failing to spot the flaw, but it lacks the resources of the NSA, which employs hundreds of code checkers to find flaws in common code. ®
Update
The NSA has now said it knew nothing about the Heartbleed bug in a brief statement on Twitter.
No comments:
Post a Comment