NSA Reportedly Exploited Heartbleed For Spying — But Strongly Denies the Allegation

Because the agency hasn’t already reportedly done enough.

National Journal
Matt Berman and Dustin Volz
April 11, 2014, 11:20 a.m.

When it bleeds, it pours.

The Na­tion­al Se­cur­ity Agency re­portedly knew of and ex­ploited the massive In­ter­net bug re­vealed to the pub­lic this week and known now as “Heart­bleed” in or­der to gath­er in­tel­li­gence in­form­a­tion on tar­gets.

This new rev­el­a­tion packs an ex­tra twist that oth­er re­cent NSA leaks have lacked: Re­gard­less of its pur­pose for in­tel­li­gence gath­er­ing, the NSA may have known for years about a his­tor­ic se­cur­ity flaw that may have af­fected up to two-thirds of the In­ter­net. In­stead of try­ing to re­pair that flaw—which has po­ten­tially im­pacted count­less people—the NSA re­portedly ma­nip­u­lated it in secret.

“Put­ting the Heart­bleed bug in its ar­sen­al, the NSA was able to ob­tain pass­words and oth­er ba­sic data that are the build­ing blocks of the soph­ist­ic­ated hack­ing op­er­a­tions at the core of its mis­sion, but at a cost,” Bloomberg first re­por­ted Fri­day, cit­ing two people “fa­mil­i­ar” with the mat­ter. “Mil­lions of or­din­ary users were left vul­ner­able to at­tack from oth­er na­tions’ in­tel­li­gence arms and crim­in­al hack­ers.”

In a state­ment late Fri­day af­ter­noon, the NSA denied the Bloomberg re­port. “NSA was not aware of the re­cently iden­ti­fied vul­ner­ab­il­ity in OpenSSL, the so-called Heart­bleed vul­ner­ab­il­ity, un­til it was made pub­lic in a private-sec­tor cy­ber­se­cur­ity re­port,” said agency spokes­wo­man Vanee Vines. “Re­ports that say oth­er­wise are wrong.”

In a fol­low-up state­ment, NSC Spokes­per­son Caitlin Hay­den said that the Obama ad­min­is­tra­tion “takes ser­i­ously its re­spons­ib­il­ity to help main­tain an open, in­ter­op­er­able, se­cure and re­li­able In­ter­net. If the Fed­er­al gov­ern­ment, in­clud­ing the in­tel­li­gence com­munity, had dis­covered this vul­ner­ab­il­ity pri­or to last week, it would have been dis­closed to the com­munity re­spons­ible for OpenSSL.”

Un­like pre­vi­ous state­ments about al­leged NSA activ­it­ies, the state­ments made by the NSA and White House today are defin­it­ive, with little room for dif­fer­ing in­ter­pret­a­tions.

The Heart­bleed bug was re­vealed pub­licly for the first time earli­er this week, and has been de­scribed by nu­mer­ous cy­ber­se­cur­ity ex­perts as one of the worst se­cur­ity glitches the web has ever en­countered. Heart­bleed is caused by a minor two-year-old flaw in soft­ware cod­ing of a pro­gram known as OpenSSL that is meant to provide ex­tra pro­tec­tion to web­sites.

Con­sid­er­able at­ten­tion has been paid to Heart­bleed’s po­ten­tial use by crim­in­al hack­ers to col­lect war chests filled with on­line pass­words, per­son­al in­form­a­tion and bank­ing data, but it re­mains un­clear wheth­er any such bad act­ors knew of or ex­ploited it pri­or to its dis­clos­ure. A fix was rolled out five days ago, but con­cerns per­sist that much of the In­ter­net’s se­cur­ity has been com­prom­ised.

Some In­ter­net free­dom and pri­vacy groups began spec­u­lat­ing that in­tel­li­gence agen­cies may have ex­ploited Heart­bleed for sur­veil­lance pur­poses shortly after news of the bug broke earli­er this week. The Elec­tron­ic Fron­ti­er Found­a­tion sug­ges­ted earli­er ex­ploit­a­tions of the bug de­tec­ted in Novem­ber of last year “makes a little more sense for in­tel­li­gence agen­cies than for com­mer­cial or life­style mal­ware.”

Earli­er Fri­day, the De­part­ment of Home­land Se­cur­ity is­sued guid­ance on Heart­bleed, say­ing that “every­one has a role to play to en­sur­ing [sic] our na­tion’s cy­ber­se­cur­ity.”

This post was up­dated Fri­day af­ter­noon after the NSA state­ment was re­leased.

What We're Following See More »
DRUG OFFENDERS
Obama Grants 111 More Commutations
6 hours ago
THE DETAILS

In a release Tuesday afternoon, the White House announced that President Obama has commuted and/or reduced the sentences of another 111 convicted criminals, mostly convicted of drug possession or trafficking. About 35 were serving life sentences.

BUT HE’S NOT ADVOCATING FOR IT
Grassley Open to Lame Duck Hearings on Garland
8 hours ago
THE LATEST

Senate Judiciary Committee Chairman Chuck Grassley (R-IA) said Monday he'd now be willing to hold a hearing on Supreme Court nominee Merrick Garland in a lame-duck session of Congress. While he said he wouldn't push for it, he said if "Hillary Clinton wins the White House, and a majority of senators convinced him to do so," he would soften his previous opposition.

Source:
DEFINITELY MAYBE
Rubio Can’t Guarantee He’ll Serve a Full Term
9 hours ago
WHY WE CARE

We can call this the anti-Sherman-esque statement: If reelected, Marco Rubio ... might serve his whole term. Or he might not. The senator, who initially said he wouldn't run for a second term this year, now tells CNN that if reelected, he wouldn't necessarily serve all six years. “No one can make that commitment because you don’t know what the future is gonna hold in your life, personally or politically,” he said, before adding that he's prepared to make his Senate seat the last political office he ever holds.

Source:
DUTERTE BECAME PRESIDENT IN JUNE
Obama to Raise Multiple Issues in Meeting With Philippines Prez
10 hours ago
THE DETAILS

Since Rodrigo Duterte took over as president of the Philippines in June, he has made a serious of controversial statements and launched a war on drugs that has led to nearly 2000 deaths. He called the US ambassador to the Philippines, Philip Goldberg, "a gay son of a bitch." Next week, President Obama will meet with President Duterte at the East Asia Summit in Laos, where he " will raise concerns about some of the recent statements from the president of the Philippines," according to White House Deputy National Security advisor Ben Rhodes.

Source:
LATE SEPTEMBER
Conservatives Preparing ‘Dry Run’ for Constitutional Convention
10 hours ago
WHY WE CARE

The Convention of States Project, which seeks to force a constitutional convention under Article V of the Constitution, will hold a "dry run" in Colonial Williamsburg starting Sept. 21. "Several states have already followed the process in Article V to endorse the convention." Thirty-four are required to call an actual convention. "The dry run in Williamsburg is meant to show how one would work and focus on the changes and potential constitutional amendments that would be proposed."

Source:
×