NSA Knew About Heartbleed and Exploited It For At Least Two Years

The NSA reportedly knew about the Heartbleed security vulnerability and exploited it for at least two years, according to a Bloomberg report. Two people familiar with the matter, told the news service that it was regularly used to gather critical intelligence.

"The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users."

The NSA's decision to keep the bug a secret left millions of users at risk. “It flies in the face of the agency’s comments that defense comes first,” said Jason Healey, director of the cyber statecraft initiative at the Atlantic Council and a former Air Force cyber officer. “They are going to be completely shredded by the computer security community for this.”


Apple recently issued a statement saying that iOS, OS X, and 'key Web-based services' were not affected by 'Heartbleed'. More details on that here.

Vanee Vines, an NSA spokeswoman, declined to comment on the agency’s knowledge or use of the bug.

Read More