NSA Knew About Heartbleed, Did Nothing, Sources Say

[Guest]

Did the NSA know about the Heartbleed bug for the past two years? Two anonymous sources told Bloomberg News the agency did.

NSA Knew About Heartbleed, Did Nothing, Sources Say : Read more

 

[thebigt42]

That is because they wrote it

 

[rgd1101]

it open source, anyone could have fixed it.

 

[ferooxidan]

They have been sying on people, why would they report a bug that allow them to do so?figured

 

[jhansonxi]

it open source, anyone could have fixed it.

Encryption systems are complicated and relatively few programmers have the expertise for understanding them. Although a common programming mistake with C, the bug wasn't obvious and was in a rather mundane section of code. It was made worse by an obsolete performance enhancement that hid the presence of the bug by masking errors caused by the eploit. There were two bug reports about problems caused by side effects of the bug but the reporters apparently didn't notice the wider risk potential. One problem of OpenSSL development is the lack of development support on the part of the millions of companies that use it.

There's one thing that most of the reports overlook - it's a server problem so the software the client is using doesn't matter. In addition, users that have the same password on multiple sites will have all their accounts compromised if any one of the sites is vulnerable, regardless if some are running M$ IIS or not.

 

[Markon101]

This is the first thing I thought of when I first heard about Heartbleed....

 

[COLGeek]

Too many folks seeing too many conspiracies. Seriously, take a deep breath and relax a bit. The US government is not out to get everyone. Don't buy into all of the hype.

 

[Camikazi]

Too many folks seeing too many conspiracies. Seriously, take a deep breath and relax a bit. The US government is not out to get everyone. Don't buy into all of the hype.

Well they are out to get everyone but they are not behind every little thing that goes wrong.

 

[Immaculate]

NSA: No we had no idea, don't you believe us? Here, drink some koolaid.

 

[John Wittenberg]

Yeah, I'll believe that when my (bleep) turns purple and smells like rainbow sherbet!

 

[BranFlake5]

Scumbag NSA.

Steals Your Data.

Does Nothing to protect it.

 

[Christopher1]

Probably did not do anything because they were actively using it to pwn various people and get their stuff.

 

[f-14]

i believe the NSA when they say they didn't know about it or abuse it.... however while every one is watching what the left hand is doing they are forgetting about the right hand, the CIA which is always under the table and it is not below them to be part of backdoor/front door, keys to all the locks policy written by socialist democrats and greedy republicans of the 1990's legislation when they controlled the house, the senate, supreme court/appeals courts, and presidency.

''If we don't pass this bill, we could find London or Frankfurt or years down the road Shanghai becoming the financial capital of the world,'' said Senator Charles E. Schumer, Democrat of New York.

 

[das_stig]

Another NSA denial, agency is not fit for purpose, any other company, would be charged with criminal activity !

 

[Ian Von Essex]

Scumbag NSA.
Steals Your Data.
Does Nothing to protect it.

They did the job perfectly... your DATA is safe on their servers !
Is not their job to fix broken servers... is their job to exploit this and "protect" your data.
Maybe they wrote it as STUX virus... good job. Problem is that NO ONE observe it until now (and is not close source either).

 

[Ian Von Essex]

Scumbag NSA.
Steals Your Data.
Does Nothing to protect it.

They did the job perfectly... your DATA is safe on their servers !
Is not their job to fix broken servers... is their job to exploit this and "protect" your data.
Maybe they wrote it as STUX virus... good job. Problem is that NO ONE observe it until now (and is not close source either).

 

[ddpruitt]

The article is pure bunk. I'm sure the "Anonymous Sources" don't actually exist and the article on Bloombergs's was written purely to sell ads. The NSA has a history of privately disclosing vulnerabilities like this to those responsible for maintaining the software. The NSA may do some shady things but a vulnerability of this level would have been disclosed.

 

[ddpruitt]

Encryption systems are complicated and relatively few programmers have the expertise for understanding them. Although a common programming mistake with C, the bug wasn't obvious and was in a rather mundane section of code.

Actually if check the git repo you see that the bug isn't a common C mistake and should have been obvious. This a mistake I would expect out of CS 101 student, not someone maintaining a widely used encryption package. I mean seriously, you don't bother checking the length of the message you received before echoing it? XKCD has the best explanation of the bug I've seen so far:

http/xkcd.com/1354/

 

[Solandri]

That is because they wrote it

It's open source. We know exactly who wrote it. Robin Seggelmann
http/www.pcpro.co.uk/news/388162/heartbleed-coder-bug-in-openssl-was-an-honest-mistake

Turns out he's one of the authors of the RFC regarding the heartbeat functionality of SSL, and his implementation contradicts the the RFC (server is supposed to not respond if the length of the requested data does not match the specified length).

So unless the NSA is somehow surreptitiously bribing foreigners working on open source security projects to insert code which subverts the purpose of the project they're working on out of love, no the NSA didn't write it.

Actually if check the git repo you see that the bug isn't a common C mistake and should have been obvious. This a mistake I would expect out of CS 101 student, not someone maintaining a widely used encryption package. I mean seriously, you don't bother checking the length of the message you received before echoing it?

It's not a common mistake if you're writing C code by the seat of your pants. But it's one I can easily see creeping in if you're editing and cutting and pasting code. When you write code like this, you do a length check once, then everything you write afterwards assumes the length has been checked. You do not re-check the length every time you use the variable.

If you rearrange the code, or cut and paste a piece while forgetting to also cut and paste the length check, suddenly you get this bug. It's a common enough error that malloc specifically has protections to prevent this bug (it'll crash the program, forcing you to re-check your code to find the bug). Unfortunately, the OpenSSL team disabled that safeguard in order to improve performance on some systems which were ran too slow with the safety check in place.

 

[stingstang]

Where are you guys buying your tinfoil hats? Amazon? No, the NSA is watching amazon, so they'd know you're on to them...