NSA denies exploiting 'Heartbleed' bug

By on
NSA denies exploiting 'Heartbleed' bug

Claims no knowledge of vulnerability before this month.

The US White House and intelligence agencies have denied the National Security Agency nor any other part of the government were aware before this month of the "Heartbleed" bug, refuting reports the spy agency exploited the glitch to gather intelligence.

The White House, the NSA and the Office of the Director of National Intelligence issued statements after it was reported the NSA was aware of the bug for at least two years and exploited it in order to obtain passwords and other basic information used in hacking operations. 

The Heartbleed bug is considered one of the most serious internet security flaws to be uncovered in recent years.

"Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before April 2014 are wrong," White House National Security Council spokeswoman Caitlin Hayden said in a statement.

"This administration takes seriously its responsibility to help maintain an open, interoperable, secure and reliable internet."

The discovery of Heartbleed by researchers with Google and a small security firm, Codenomicon, prompted the US Homeland Security Department to advise businesses to review their servers to see if they were using vulnerable versions of widely used software known as OpenSSL.

OpenSSL is used to encrypt email and other communications and to protect the websites of many internet companies. The bug allows hackers to steal data without a trace.

NSA spokeswoman Vanee Vines said in a separate statement: "NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report."

Hayden said the federal government relies on OpenSSL to protect the privacy of users of government websites and other online services.

"If the federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL."

Hayden said when US agencies discover a new vulnerability in commercial and open-source software, "it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose." Such vulnerabilities are known as "zero-day" flaws because the software developers have had zero days to fix them.

In December, a five-member advisory panel convened to review electronic surveillance policy urged the White House to sharply curtail the use of undisclosed flaws and stop undercutting encryption standards. 

In late February, a senior White House official said the Obama administration was intensively studying both issues.

The recent statements confirmed the review had already "reinvigorated an interagency process for deciding when to share vulnerabilities" on a case-by-case basis.

The US. government warned banks and other businesses to be on alert for hackers seeking to steal data exposed by the bug, as a German programmer who volunteered with OpenSSL took responsibility for inadvertently launching the security crisis.

Got a news tip for our journalists? Share it with us anonymously here.

Most Read Articles

Log In

  |  Forgot your password?