March 26, 2023
NSA Knew About Heartbleed and Exploited It For At Least Two Years

NSA Knew About Heartbleed and Exploited It For At Least Two Years

Posted April 11, 2014 at 9:05pm by iClarified · 13313 views
The NSA reportedly knew about the Heartbleed security vulnerability and exploited it for at least two years, according to a Bloomberg report. Two people familiar with the matter, told the news service that it was regularly used to gather critical intelligence.

"The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users."

The NSA's decision to keep the bug a secret left millions of users at risk. “It flies in the face of the agency’s comments that defense comes first,” said Jason Healey, director of the cyber statecraft initiative at the Atlantic Council and a former Air Force cyber officer. “They are going to be completely shredded by the computer security community for this.”

Apple recently issued a statement saying that iOS, OS X, and 'key Web-based services' were not affected by 'Heartbleed'. More details on that here.

Vanee Vines, an NSA spokeswoman, declined to comment on the agency’s knowledge or use of the bug.

Read More

NSA Knew About Heartbleed and Exploited It For At Least Two Years

Add Comment
Would you like to be notified when someone replies or adds a new comment?
Yes (All Threads)
Yes (This Thread Only)
iClarified Icon
Would you like to be notified when we post a new Apple news article or tutorial?
You must login or register to add a comment...
qba - April 17, 2014 at 4:15pm
Shame in you America/NSA that's why smart hackers and security experts should not work for you at all because you don't know better, you just used us like you have from centuries.
AaronL - April 14, 2014 at 7:24pm
The whole point of the Heartbleed bug was to exploit a bug in OpenSSL, so this would affect all servers that used that protocol. If you set complex passwords to start off with then your login details should be OK. By advising users to change the passwords takes away some of the legal responsibility in the interim. Although I can't believe this has been known for nearly two years and nobody cared enough to patch it.
nitays - April 14, 2014 at 8:36am
These NSA People... True bastards.
AaronnL - April 12, 2014 at 8:46pm
The NSA are a bunch of ***** really. Do I as I say, not do as I do.
Great! - April 12, 2014 at 7:04am
I'm sorry but declining to comment in this case just shows me that they are guilty as charged.
mifki - April 11, 2014 at 11:57pm
Heartbeat code has been added in version 1.0.1 released 14 Mar 2012. Taking into account that only two years total passed since then and that some time was required to update to that version, it seems somewhat unlikely that they could exploit it "for at least two years".
mifki - April 12, 2014 at 12:02am
...even if they knew about the vulnerability from the beginning, which I don't believe a well.
Wee Willy Spunker
Wee Willy Spunker - April 11, 2014 at 9:16pm
Are they trying to target an os not immune to malware or heartbleed forcing people off of it?
Recent. Read the latest Apple News.
Tutorials. Help is here.
Where to Download macOS Ventura
AppleTV Firmware Download Locations
Where to Download iPod touch Firmware Files From
Where To Download iPad Firmware Files From
Where To Download iPhone Firmware Files From
Deals. Save on Apple devices and accessories.