© SOTT.net
Updated The tech world is aflutter over the Heartbleed encryption flaw in OpenSSL, but it seems that the bug was no surprise to the analysts of the NSA, since they have reportedly been using it for two years to spy on data traffic.
Two sources familiar with the matter told Bloomberg that NSA staff picked up on the fatal flaw shortly after the code was published, and added it into the agencies box of hacking tricks. One source said Heartbleed was used regularly for years, and that the agency decided not to warn US citizens and companies that their data was at risk.
One of the NSA's specific roles is to safeguard national communications and online security infrastructure; indeed, the agency states as much on its website. "We will protect national security interests by adhering to the highest standards of behavior," they write.
This appears to have been lacking if Friday's report is correct.
"It flies in the face of the agency's comments that defense comes first," said Jason Healey, director of the cyber statecraft initiative at the Atlantic Council and a former Air Force cyber officer. "They are going to be completely shredded by the computer security community for this."
News of the Heartbleed bug surfaced on April 7, and since then the biggest names in the technology industry have been scrambling to patch up their software and fix the flaw. Hackers have already started attacks using the vulnerability, and the internet has probably seen more password changes in the last week than at any point in its history.
Most websites have now upgraded to OpenSSL 1.0.1g, which fixes the problem, but the flaw will also affect software on PCs, phones, and tablets, according to the computer security folks at the SANS Institute. The open source community has been criticized for failing to spot the flaw, but it lacks the resources of the NSA, which employs hundreds of code checkers to find flaws in common code. ®
Update
The NSA has now said it knew nothing about the Heartbleed bug in a brief statement on Twitter.
© Twitter
now it makes sense.my bro went to stay with another family a while back.the husband has a high ranking job with the DoD and microsoft.for some reason he didnt want my bro there anymore and sent him home.so he wouldnt try to contact any of the other family member he went in and deleted every internet profile my bro had.facebook,instagram,twitter,etc without the need of any passwords.just a few clicks of the mouse is all it took.