Pierluigi Paganini April 12, 2014

The US National Security Agency knew for at least two years about the Heartbleed flaw, and exploited it for cyber attacks according Bloomberg.

The Internet community was shocked by the disclosure of the Heartbleed flaw, the vulnerability affects OpenSSL library and allows an attacker to reveal up to 64kB of memory to a connected client or server.

Hundreds of thousands websites and networking equipment on the Internet were vulnerable for years to Heartbleed  bug, allowing target violation and passwords grabbing.

Many experts speculated that the Heartbleed flaw was already exploited for cyber attacks in the recent months, the first suspects are related state-sponsored hackers, of course first thoughts goes to NSA and its TAO cyber unit.

While the U.S. Department of Homeland Security issued a warning about Heartbleed, Bloomberg reported that the National Security Agency was one of the intelligence agencies aware of the Heartbleed flaw and it was actively exploiting the vulnerability for the last two years.

“While there have not been any reported attacks or malicious incidents involving this particular vulnerability confirmed at this time, it is still possible that malicious actors in cyberspace could exploit un-patched systems. ” states the US DHS related to the possibility that bad actors could have exploited Heartbleed flaw.

The NSA secret documents disclosed by Snowden revealed a global surveillance network that spied on everything, internal communications, allies  and foreign companies.

“The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said.” reported Bloomberg on Heartbleed.

On many occasions we have read about cyber capabilities of the NSA, and in particular of its abilities to break encryption processes, some experts also hypothesized the used of Quantum Computing

Just a few minutes ago the NSA in a tweet denied to have used the Hearthbleed flaw in the past.

Waiting for another disturbing truth, all the website administrators are invited to apply the patch already available for OpenSSL library.

Pierluigi Paganini

(Security Affairs –  Heartbleed flaw, NSA)