NSA secretly exploited devastating Heartbleed bug for years, report says
News of the Heartbleed bug has brought the Web to its knees, and Bloomberg says the NSA has been exploiting it for at least two years.
PC World - You had to see this one coming.
This week, it came to light that a small error in the open-source OpenSSL implementation of the SSL encryption protocol opened a gaping hole in the security of hundreds of thousands websites and networking equipment across the Net--and that hole had been wide open and exploitable for years. Passwords could be easily grabbed. User names matching those passwords could be easily grabbed. Heck, userdata could be easily grabbed. The "Heartbleed" moniker attached to the devastating bug seemed all too apt.
And Friday afternoon, Bloomberg reported that the National Security Agency has been aware of and actively exploiting the Heartbleed bug for at least two full years, citing "two people familiar with the matter."
Ironically, the report comes on the same day that the U.S. Department of Homeland Security issued a warning about Heartbleed, stating that "While there have not been any reported attacks or malicious incidents involving this particular vulnerability confirmed at this time, it is still possible that malicious actors in cyberspace could exploit un-patched systems."
Nagging NSA concerns
The allegations are sure to cause an uproar in the security community, which is still struggling to come to terms with the revelations revealed by whistleblower Edward Snowden.
Leaked NSA documents provided to reporters by Snowden have revealed an agency casting a wide--and often domestic--surveillance dragnet, spying on American emails and web searches,A gobbling up metadata from smartphonesen masse, and even tapping into the internal communication infrastructures of Internet giants like Yahoo and Google.
A September Snowden-supplied revelation revealed that the NSA can easily defeat many of today's encryption technologies, and in an aside that now seems precognizant, the SSL protocol was then rumored to be a particular favored target for the Agency.
NSA representatives declined to comment to Bloomberg about the report.
What can you do?
While the security of open-source software has been debated in the wake of Heartbleed's devastation, the Web is already recovering from the bug's widespread mayhem. There's already an OpenSSL fix for Heartbleed, which many website administrators are scrambling to implement.
Given the nature of the Heartbleed bug--which reveals information stored in a web server's RAM, as wonderfully summed up by XKCD--you actually don't want to change your passwords or even visit sites that were vulnerable, but have yet to be fixed. Be sure to read PCWorld's comprehensive guide to staying safe from Heartbleed, and check out our coverage of sites known to have been affected by the bug.
- EndPoint Interactive eGuide In this eGuide, Network World, Computerworld, and CIO examine two endpoint trends - BYOD and collaboration - and offer tips and advice on...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!