National Insecurity: NSA Said to Have "Exploited" Heartbleed Flaw for Years

So first of all, here are the passwords you'll need to change to protect yourself from (further?) intrusion due to the "Heartbleed" glitch.

This bug -- or is it a feature? -- permits people to hack into your accounts.

The man who inserted this bit of faulty (?) code says he did not do so deliberately.

Meanwhile, the NSA is said to have been using the "Heartbleed" exploit for its own purposes.

The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said.

The NSA’s decision to keep the bug secret in pursuit of national security interests threatens to renew the rancorous debate over the role of the government’s top computer experts.

Heartbleed appears to be one of the biggest glitches in the Internet’s history, a flaw in the basic security of as many as two-thirds of the world’s websites. Its discovery and the creation of a fix by researchers five days ago prompted consumers to change their passwords...

Putting the Heartbleed bug in its arsenal, the NSA was able to obtain passwords and other basic data that are the building blocks of the sophisticated hacking operations at the core of its mission, but at a cost. Millions of ordinary users were left vulnerable to attack from other nations’ intelligence arms and criminal hackers.

“It flies in the face of the agency’s comments that defense comes first,” said Jason Healey, director of the cyber statecraft initiative at the Atlantic Council and a former Air Force cyber officer. “They are going to be completely shredded by the computer security community for this.”

This is scary. I'm not even so much bothered by the NSA itself preserving a backdoor into my private stuff. I always figured they could do that anyway, if they wanted.

But they've also exposed everyone to criminal hacking and even compromise by foreign intelligence services.

What the hell. What the unholy hell.

Thanks to @theh2.

posted by Ace at 03:16 PM

| Access Comments