12 ms·
This was never confirmed with any evidence and bloomberg only cites anonymous sources. Given Bloomberg's bad track record on infosec stories I say I have my dou
by hannob 7y ago
This was never confirmed with any evidence and bloomberg only cites anonymous sources. Given Bloomberg's bad track record on infosec stories I say I have my doubts.
Of course I don't know whether or not the NSA knew about Heartbleed. But nothing that would even remotely qualify as evidence has ever been presented.
- ClumsyPilot 7y agoon the balance of probabilities, it is probably true. I would expect NSA to make use of any vulnerabilities they find, because their job is to hack others, not to keep us safe. Unfortunately.
- wnevets 7y agoWell the real question isn't if NSA used it but if they knew about it long before everyone else and never reported it.
- grumio 7y agoIt's their SOP. See: eternal blue. https://en.m.wikipedia.org/wiki/EternalBlue https://en.m.wikipedia.org/wiki/EternalBlue
- tptacek 7y agoThat's how CNO exploitation works. They generally can't report; their adversaries are recording their own networks, and will retrospectively detect intrusions.
- jjtheblunt 7y agoNSA is resposible for so-called SIGINT and SIGSEC, acronyms for signals intelligence, to which you refer, and signals security, which IS to keep our communications safe. It seems of course that SIGINT is what's "popular" in news.
- deleted 7y ago[deleted]
- tareqak 7y agoI would argue that such a clear conflict in these two priorities should necessitate having a bespoke separate governmental organization for SIGSEC, so that the NSA can freely focus on SIGINT.
- jjtheblunt 7y agoWhat is the conflict in priorities that you mean? I ask because I considered code breaking and code making complimentary, in the sense they debug one another somewhat. My guess is that this chance to debug one another motivates their coresidence in a single agency.
- greendestiny 7y agoDisclosing vulnerabilities.
- blackflame7000 7y agoThey should definitely disclose vulnerabilities in American made software for SIGSEC. If it’s foreign then not disclosing it would be SIGINT
- kelnos 7y agoThe problem with that is there's a lot of software that's American made that is also used by potential targets of SIGINT.
- ClumsyPilot 7y agoIf the software is foreign made and used in US, americans are still vulnerable. And opensource isn't American/national
- kelnos 7y ago
- deleted 7y ago[deleted]
- Rebelgecko 7y agoThe NSA has an interesting exhibit that talks about Heartbleed at their museum in Maryland (worth a visit if you're in the area—they have some Enigma machines which are a lot of fun). Of course I don't think the exhibit was there before the bug was publicly known.
- arthurcolle 7y agoWhere in Maryland is this? Close to Ft. Meade?
- navbaker 7y agoDirectly next to Ft Meade
- dillonmckay 7y ago“ Of course I don't think the exhibit was there before the bug was publicly known.” Would that be the smoking gun?
- boring_twenties 7y agoI haven't been to the Cryptologic museum but I did get to see one of these Enigmas as it happened to be on loan to the American Computer Museum in Bozeman, MT when I visited there. If you like museums, don't miss this one, it was really awesome. Oh, and free.
- munk-a 7y agoWhile I am skeptical of bloomberg, I'm even more skeptical of the NSA as they've burned all their goodwill in my eyes at this point. So I'm in the "probably true, if not then probably something nearly identical happened with a different serious vulnerability" camp.
- tptacek 7y agoWhat "goodwill" would be involved here? NSA is chartered to exploit things like Heartbleed.
- monocasa 7y agoThey're also chartered to provide information assurance.
- JasonFruit 7y agoOne of those goals benefits the people with power who are above the NSA. The other provides a benefit to the public at large that few will notice. Which goal do you think is likely to be top priority?
- monocasa 7y agoWell, in the case of heartbleed where first the NSA found it, and an independent researcher found it, and the DoD uses Linux and OpenSSL all over the place, you'd think that the information assurance side would be better represented. Who knows how many adversaries were using that as well before it was public (hence the whole point of responsible disclosure). Edit: Like, stuff like cryptanalysis of SM4 is for sure on the table. I can even see their neat Diffie-Hellman hack that costs $100m per nonce. But a trivially remotely exploitable memory safety bug in software that runs large sections of the military? Like, come on.
- admax88q 7y agoTo be fair, I bet the NSA knows better than anyone if any given exploit is being used in the wild.
- monocasa 7y agoAs someone who has designed shipping HDL including more SPI masters than I can count, and now works as a security researcher (among a couple other hats I wear aty current job), I really think Bloomberg got dragged through the mud. Everything they said about the BMC was plausible. It was bizzare hearing about how such a scheme would literally break the laws of physics, when by accident (read shitty, undebugged HDL) I've caused exactly what they were claiming.
- Sephr 7y agoI've similarly expressed this opinion openly on Twitter and then I was immediately harassed by Tavis Ormandy of Google Project Zero in my DMs with meme-y taunting messages. It's odd how dismissive some supposedly-serious security researchers are of hardware implant capabilities.
- DaiPlusPlus 7y ago> It's odd how dismissive some supposedly-serious security researchers are of hardware implant capabilities. And it really doesn’t take much effort to sneak even a bashbunny into an internal USB header - especially in the last mile of the supply-chain. Get a temp-job as a UPS delivery driver in an area that services the datacenter of your target, whenever you deliver a sever box - open it up, add your implant, re-seal it all in the privacy of the back of your delivery truck, and that’s it.
- taviso 7y agoThis didn't happen, I have never DM'd you.
- clubm8 7y ago>Given Bloomberg's bad track record on infosec stories I say I have my doubts. This is all speculation: I've noticed a weird amount of ex-CIA find their way to that publication. I sometimes wonder if the China story was some kind of plant. So then the question becomes, do we think this is truthful propaganda or just propaganda?
- cwkoss 7y agoIf CIA has editorial control over Bloomberg, would be a great way to manipulate the market to fund black ops.
- clubm8 7y agoControl is a strong word. I think from my reading, they have journalists willing to listen who don't have the skills (or inclination) to sniff bs. The article seems to not differentiate between SSL and TLS for example, mentioning people breaking the former.
- Iv 7y agoI consider the likelihood that the NSA made a security audit of OpenSSL very high. And given the horror stories that we heard from people trying to fix it, heartbleed is probably not the only thing they found.
- michaco33 7y agoRight, hold the most clandestine organizations in the world to the same standards as petty theft. Do we really expect the NSA to be trailing HN in knowledge on zero-day vulnerabilities?