Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA Said to Exploit Heartbleed Bug for Intelligence for Years

bloomberg.com

Post reply on HN
Print view View original

111–120 of 192 posts

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#111

Post by danielweber »

lot49a wrote: post #22
err4nt wrote: post #13

Do we have anything that leads us to believe the NSA was aware of heartbleed at all before we found out, other than speculation because of their resources?

We have "two people familiar with the matter" which is to say sources that Bloomberg thought were credible enough to lead a story with.

Who is "familiar with the matter"? NSA insiders? People who've read the Snowden docs?

I wonder if Bruce "probability is close to one that every target has had its private keys extracted by multiple intelligence agencies" Schneier is one of them.

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#113

Post by hackinthebochs »

arrrg wrote: post #90
joshstrange wrote: post #37

Earlier quoted context omitted.

>> The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said. (emphasis mine) It's pretty weak IMHO but I don't really doubt it.

The bug only existed in the wild for two years and less than a month. I’m not sure what the “at least two years” means in that context. The NSA can’t have known this bug for a lot longer and “at least two years” implies to me “at least 24 months and possibly many more”, not “at least 24 months, at most 25”.

The trick is to put yourself in the context of a potential leaker. Is this person technical? Would they have the skill to distinguish between heartbleed and another equally powerful exploit? What "at least two years" means to me is not that they knew specifically about heartbleed shortly after it was introduced, but that there may be another equally damaging bug the NSA exploits that a non-programmer could easily confuse. After all, I'm sure they don't have this exploit labelled "heartbleed" in their database.

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#114

Post by drcube »

[deleted] wrote: post #110
TallGuyShort wrote: post #76

Earlier quoted context omitted.

And I also wouldn't say that the existence of a bug was caused by the license that was used. It's not like me keeping all the code to myself would make me a better programmer.

[deleted]

>> Well, if you were keeping all the code to yourself you presumably wouldn't be accepting poorly reviewed patches from random people.

How does this follow? You can just as easily hire "random people" to make mistakes as you can accept mistakes from people you don't pay. The problem is poorly reviewed code either way. Not the license.

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#115

Post by protomyth »

tptacek wrote: post #108
protomyth wrote: post #104

Earlier quoted context omitted.

My personal opinion is that I doubt the NSA introduced it, but if it allowed other countries to exploit US citizens and the NSA knew about it, then that is indefensible behavior. That being said, it would be a pretty standard tactic for an AG to look at who paid the people who did the work. It is a pattern in a lot of different types of investigations and familiar to an AG. Will they find anything? Doubtful. Will tha…

I think it's hilarious to see people who are ostensibly zealous advocates of privacy lobbying to get prosecutors to subpoena the financial records of the people who invest their free time in building privacy-protecting software. I am at the same time comfortable filing this under "things that will never happen".

Hold up, do you think I actually want the scenario I stated to happen?

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#116

Post by throwaway2048 »

Steko wrote: post #107
diydsp wrote: post #61

Earlier quoted context omitted.

Their job is not to spy on behalf of the country. Their job is to keep us safe. Letting us all run around with humungous holes in our security for years was a risk to our national security. How do you think the Chinese were able to clone our weapons systems so well? Shit like this.

Yeah NSA's job is to fix open source bugs, whatever. NSA is a spy agency, expecting them not to use vulnerabilities they find is like sending them into a gunfight with a pocketful of rocks. Ask the Palestinians how that works out in the long run. I think much of the NSA's surveillance is unconstitutional and should be rolled back by at least 2 orders of magnitude. That doesn't have to entail turning the world over to…

>That doesn't have to entail turning the world over to Russian and Chinese hackers.

That's exactly what they do when they allow bugs like this to continue to exist, rather than working to fix holes, not exploit them.

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#117

Post by sp332 »

zacinbusiness wrote: post #100
jobu wrote: post #3

This looks like another case where the actions of the NSA are the opposite of what's in the best interest of US Citizens.

Are there any cases where the actions of the NSA are in any way beneficial to US citizens? Can they show that they have ever done anything positive at all? Have they saved a single life? Stopped a single threat? Or are they too busy jerking it to sexting pics and playing WoW (seriously? Come on, guys) to actually do anything useful with the BILLIONS of dollars of money that they get to play with?

Lots of education: Conferences, teacher training, student scholarships. Also, selinux.

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#118

Post by [deleted] »

jrochkind1 wrote: post #102

> The SSL protocol has a history of security problems, Lewis said, and is not the primary form of protection governments and others use to transmit highly sensitive information. > “I knew hackers who could break it nearly 15 years ago,” Lewis said of the SSL protocol. Anyone know wtf he's talking about?

[deleted]

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#119

Post by jlgaddis »

Zigurd wrote: post #55
maxerickson wrote: post #41

Earlier quoted context omitted.

I don't think average people (so to speak) really care about their email.

Even n00bs understand that if their email gets jacked, that can be used to reset all their other passwords and jack those accounts.

I'm not so sure, I know plenty of people who don't realize that until it's pointed out to them. Even then, many don't even care ("I don't have anything important anyways...").

Re: NSA Said to Exploit Heartbleed Bug for Intelligence for Years

#120

Post by rurban »

tptacek wrote: post #70
[deleted] wrote: post #68

Earlier quoted context omitted.

[deleted]

The same amount of time: it was apparently found with a fuzzer.

I'm not so sure about the fuzzer. We have several good symbolic fuzzers around by ourselves, like fuzzgrind, but not so many open symbolic bug finders, like BAP, MAYHEM, EXE, forensic, cmbc. It could also be that they just added symbolic annotations like with Frama-C (as done with portalssl) and found bugs thereby. openssl nor gnutls is not in the shape to add something like this by themselves.

It's much easier to come up with workable exploits in decent time with symbolic input and the stp or z3 solver than with simple fuzzing.

Post reply on HN