Heartbleed bug: NSA denies exploiting glitch to harvest information
The statement comes after claims made by sources 'close to the situation' alleging that the spy agency knew about Heartbleed for two years
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.The White House and US intelligence agencies denied on Friday that spy agencies exploited the Heartbleed glitch to gather intelligence.
The statements follow a Bloomberg report citing two unnamed sources close to the situation which accused the US National Security Agency (NSA) of being aware of the bug for at least two years, and using it to harvest passwords and other basic information used in hacking operations.
The Heartbleed bug, which emerged as an online threat last week, is considered one of the most serious Internet security flaws to be uncovered in recent years.
“Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before April 2014 are wrong,” White House National Security Council spokeswoman Caitlin Hayden said in a statement.
“This administration takes seriously its responsibility to help maintain an open, interoperable, secure and reliable Internet,” Hayden added.
Bloomberg was not immediately available to comment.
Researchers with Google Inc and a small security firm, Codenomicon discovered that vulnerable versions of a widely used software known as Open SSL allowed hackers to steal data without being traced. Companies including Facebook Inc, Google Inc and Yahoo Inc were all affected.
Hayden said the federal government relies on OpenSSL to protect the privacy of users of government websites and other online services. “If the federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL,” Hayden added.
She added that when US agencies discover a new vulnerability in commercial and open-source software, “it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose.” Such vulnerabilities are known as “zero-day” flaws because the software developers have had zero days to fix them.
NSA spokeswoman Vanee Vines said in a separate statement: “NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report.”
The activities of the NSA have come under sharp scrutiny since former agency contractor Edward Snowden leaked numerous documents exposing expansive U.S. surveillance efforts.
In December, a five-member advisory panel convened to review electronic surveillance policy urged the White House to sharply curtail the use of undisclosed flaws and stop undercutting encryption standards. In late February, a senior White House official said the Obama administration was intensively studying both issues.
Additional reporting by Reuters
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments