When it bleeds, it pours.
The National Security Agency reportedly knew of and exploited the massive Internet bug revealed to the public this week and known now as “Heartbleed” in order to gather intelligence information on targets.
This new revelation packs an extra twist that other recent NSA leaks have lacked: Regardless of its purpose for intelligence gathering, the NSA may have known for years about a historic security flaw that may have affected up to two-thirds of the Internet. Instead of trying to repair that flaw—which has potentially impacted countless people—the NSA reportedly manipulated it in secret.
“Putting the Heartbleed bug in its arsenal, the NSA was able to obtain passwords and other basic data that are the building blocks of the sophisticated hacking operations at the core of its mission, but at a cost,” Bloomberg first reported Friday, citing two people “familiar” with the matter. “Millions of ordinary users were left vulnerable to attack from other nations’ intelligence arms and criminal hackers.”
In a statement late Friday afternoon, the NSA denied the Bloomberg report. “NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report,” said agency spokeswoman Vanee Vines. “Reports that say otherwise are wrong.”
In a follow-up statement, NSC Spokesperson Caitlin Hayden said that the Obama administration “takes seriously its responsibility to help maintain an open, interoperable, secure and reliable Internet. If the Federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL.”
Unlike previous statements about alleged NSA activities, the statements made by the NSA and White House today are definitive, with little room for differing interpretations.
The Heartbleed bug was revealed publicly for the first time earlier this week, and has been described by numerous cybersecurity experts as one of the worst security glitches the web has ever encountered. Heartbleed is caused by a minor two-year-old flaw in software coding of a program known as OpenSSL that is meant to provide extra protection to websites.
Considerable attention has been paid to Heartbleed’s potential use by criminal hackers to collect war chests filled with online passwords, personal information and banking data, but it remains unclear whether any such bad actors knew of or exploited it prior to its disclosure. A fix was rolled out five days ago, but concerns persist that much of the Internet’s security has been compromised.
Some Internet freedom and privacy groups began speculating that intelligence agencies may have exploited Heartbleed for surveillance purposes shortly after news of the bug broke earlier this week. The Electronic Frontier Foundation suggested earlier exploitations of the bug detected in November of last year “makes a little more sense for intelligence agencies than for commercial or lifestyle malware.”
Earlier Friday, the Department of Homeland Security issued guidance on Heartbleed, saying that “everyone has a role to play to ensuring [sic] our nation’s cybersecurity.”
This post was updated Friday afternoon after the NSA statement was released.
What We're Following See More »
As the Russia investigation heats up, "the role of Marc E. Kasowitz, the president’s longtime New York lawyer, will be significantly reduced. Mr. Trump liked Mr. Kasowitz’s blunt, aggressive style, but he was not a natural fit in the delicate, politically charged criminal investigation. The veteran Washington defense lawyer John Dowd will take the lead in representing Mr. Trump for the Russia inquiry."
President Trump's attorneys are "actively compiling a list of Mueller’s alleged potential conflicts of interest, which they say could serve as a way to stymie his work." They plan to argued that Mueller is going outside the scope of his investigation, in inquiring into Trump's finances. They're also playing small ball, highlighting "donations to Democrats by some of" Mueller's team, and "an allegation that Mueller and Trump National Golf Club in Northern Virginia had a dispute over membership fees when Mueller resigned as a member in 2011." Trump is said to be incensed that Mueller may see his tax returns, and has been asking about his power to pardon his family members.
In addition to ties between Russia and the Trump campaign, Robert Mueller's team is also "examining a broad range of transactions involving Trump’s businesses as well as those of his associates, according to a person familiar with the probe. FBI investigators and others are looking at Russian purchases of apartments in Trump buildings, Trump’s involvement in a controversial SoHo development in New York with Russian associates, the 2013 Miss Universe pageant in Moscow, and Trump’s sale of a Florida mansion to a Russian oligarch in 2008, the person said. The investigation also has absorbed a money-laundering probe begun by federal prosecutors in New York into Trump’s former campaign chairman Paul Manafort."
Special Counsel Robert Mueller's team is "is examining a broad range of transactions involving Trump’s businesses as well as those of his associates", including "Russian purchases of apartments in Trump buildings, Trump’s involvement in a controversial SoHo development with Russian associates, the 2013 Miss Universe pageant in Moscow and Trump’s sale of a Florida mansion to a Russian oligarch in 2008."
"A Senate bill to gut Obamacare would increase the number of uninsured people by 32 million and double premiums on Obamacare's exchanges by 2026, according to an analysis from the nonpartisan Congressional Budget Office. The analysis is of a bill that passed Congress in 2015 that would repeal Obamacare's taxes and some of the mandates. Republicans intend to leave Obamacare in place for two years while a replacement is crafted and implemented."