This week, it came to light that a small error in the open-source OpenSSL implementation of the SSL encryption protocol opened a gaping hole in the security of hundreds of thousands websites and networking equipment across the Net.
That hole had been wide open and exploitable for years. Passwords could be easily grabbed, and so could user names that matched them.
So could user data. The ‘Heartbleed’ moniker attached to the devastating bug seemed all too apt.
And Friday afternoon, Bloomberg reported that the National Security Agency has been aware of and actively exploiting the Heartbleed bug for at least two years, citing “two people familiar with the matter.”
Ironically, the report came on the same day that the U.S. Department of Homeland Security issued a warning about Heartbleed, stating that “While there have not been any reported attacks or malicious incidents involving this particular vulnerability confirmed at this time, it is still possible that malicious actors in cyberspace could exploit unpatched systems.”
Nagging NSA concerns
The allegations are sure to cause an uproar in the security community, which is still struggling to come to terms with the revelations revealed by whistleblower Edward Snowden.
Leaked NSA documents provided to reporters by Snowden have revealed an agency casting a wide – and often domestic – surveillance dragnet, spying on American emails and web searches, gobbling up metadata from smartphones en masse, and even tapping into the internal communication infrastructures of Internet giants like Yahoo and Google.
A September Snowden-supplied revelation revealed that the NSA can easily defeat many of today’s encryption technologies, and in an aside that now seems precognizant, the SSL protocol was then rumoured to be a particular favoured target for the agency.
NSA representatives declined to comment to Bloomberg about the report.
While the security of open-source software has been debated in the wake of Heartbleed’s devastation, the Web is already recovering from the bug’s widespread mayhem. There’s already an OpenSSL fix for Heartbleed, which many website administrators are scrambling to implement.