NSA denies reports it exploited 'Heartbleed' to spy on consumers

[MindMover]

Source: LATIMES

The National Security Agency denied a report that it has exploited the "Heartbleed" bug to spy on consumers for the past two years.

"NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private sector cybersecurity report," the agency said in a statement. "Reports that say otherwise are wrong. Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before April 2014 are wrong."

The statement came in response to a story by Bloomberg on Friday that claimed the NSA had known about the vulnerability in OpenSSL since it was first introduced two years ago.

OpenSSL is the open-source encryption software that 66% of all servers on the Internet use to provide additional security. Late last week, security researchers discovered a flaw that would allow hackers using a simple piece of software to easily access user IDs and passwords.

Read more: http://www.latimes.com/business/technology/la-fi-tn-report-nsa-denies-heartbleed-bug-spy-consumers-20140411,0,5235051.story

---

Wow, that was fast, denial ...is not just a river in the middle east ../b]

[hobbit709]

1. Does any crook admit what they did was illegal?

[RiverNoord]

11. lol - these days a formal denial from the NSA

is virtually solid proof that they're doing whatever it is that they are denying...

[ucrdem]

12. All the same I'd prefer to see proof, solid or otherwise.

That's been sorely lacking in this endless melodrama.

[fbc]

2. We didn't know about it, and if we did we'd lie about knowing anyway

Of what use is any public statement from the NSA?

[frylock]

3. well that settles that then, right?

[grasswire]

4. no kidding nt

[joshcryer]

5. Don't believe it.

Only explanation as to how they got FB chats.

[marions ghost]

6. Why do we put up with these lies

coming from this rogue government agency?

They are obviously NOT working in our interests whatsoever.

[Jesus Malverde]

7. "recently identified vulnerability"

You have to parse their language carefully, They could have said "the vulnerability", but instead chose to narrow it down to "recently identified" it's likely they have their own slightly different exploit.

[Newsjock]

8. This just means that they're using an even bigger vulnerability

One that we haven't been told about yet.

Thank you, NSA, for keeping me and my family safe. You are true American patriots! Are we off? Good ... well, that oughta hold the little bastards.

[pragmatic_dem]

9. But they aren't stealing your data, they are just stealing your meta-data. See the difference?

I predict more lying to Congress who will roll over and kiss NSA's ass begging them not to leak all the shit they've collected on the skunks.

[ucrdem]

10. Epic FUD fail.

No source for the claim in the Bloombag article:

http://www.democraticunderground.com/?com=view_post&forum=1014&pid=778341

p.s. FUD = Fear, Uncertainty and Doubt

[MindMover]

13. You are claiming this is false with no proof ...

I would suggest you prove falsification of this information ... and stop calling FUD with no proof of your own ...

[ucrdem]

14. Check the link or is that too much to ask?

The burden is proof is on Bloombag and they failed to provide so much as a shred. Thus, FUD fail. The epic part is my contribution, I'll give you that.

[MindMover]

15. So just like you, they made it up .... nt

[ucrdem]

16. Unlike me, they claimed they were reporting news. nt

[MindMover]

17. So you are just posting your opinion .... nt

[ucrdem]

19. Bloombag's failure to provide proof is factual.

They also presented their claims deceptively. The opinion that this failure is epic is mine, yes. But a failure to report honestly it is.

[MindMover]

21. How is it deceptive to publish there claims in a worldwide publication ...? ..nt

[ucrdem]

22. Because a reputable news organization supports its claims with credible evidence

not with deceptive references to its own misreporting.

[MindMover]

23. You are not taking into account that we are talking about the most deceptive

organization in American history, with maybe the CIA holding a close second ....

You are being an apologist for a highly disliked, distrusted, devious entity that really has little to no oversight ...

[ucrdem]

24. Let's focus on the article. It's deceptive FUD and clearly meant to be so.

I suppose I'll be told next that it was all just a big misunderstanding.

[MindMover]

26. You are being deceptive in misunderstanding the severity of NSA's

involvement in your life and the lives of every American ....

whatever your reasoning about this article, there is no justification for an agency of the USA being so totally above any law ....

[ucrdem]

27. Look, your or my "feelings" about the NSA are not the issue. Okay?

[MindMover]

28. WHAT ... you have been claiming FUD on an article that you apparently feel is false reporting ....

Where is your proof that it is false reporting ... ?

[ucrdem]

29. I linked to it in the first post you responded to. Here it is again:

The only source for this claim is apparently this very article, which cites itself. From the OP {Bloomberg} article, which does not identify or link to any earlier Bloomberg article:

The NSA said in response to a Bloomberg News article that it wasn’t aware of Heartbleed until the vulnerability was made public by a private security report. The agency’s reported decision to keep the bug secret in pursuit of national security interests threatens to renew the rancorous debate over the role of the government’s top computer experts.

http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html

Articles reporting same found via Google search all point to this same Bloombag whopper as a source.



Epic FUD fail, and no this doesn't mean I heart the NSA.

http://www.democraticunderground.com/?com=edit&forum=1014&thread=778121&pid=778341

[MindMover]

32. Whatever your game is, it is not working on me ...

Discredit, belittle, misinformation are all trademarks of the agency you are supporting ....

[BlindTiresias]

18. More info

http://www.techdirt.com/articles/20140410/12594026871/big-question-when-did-nsa-know-about-heartbleed.shtml

[ucrdem]

20. Interesting. Admits the NSA "angle" is purely speculative, which it is.

The simultaneous "discoveries" of this flaw seem to me suspicious, but interesting nonetheless.

[blkmusclmachine]

25. Uh, huh. Sure they didn't

[PSPS]

30. Another "least untruthful answer."

Also notice the use of the noun "consumers."

I won't consider the NSA as trustworthy (or this as America anymore) until they raze the 240-acre hard drive in Utah.

[pa28]

31. 'We weren't using Heartbleed. We were using the other hole you don't know about yet.'

At this point I just assume they are lying outright or lying by omission.

[Pholus]

33. I love NSA-speak these days.

Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before April 2014 are wrong."

1) We considered it a valuable feature, not a vulnerability.
2) We called it a way cooler codename, not some lame "Heartbleed."
3) April 2014 was the first time we heard the name "Heartbleed."
4) You guys are idiots, there is actually a bigger vulnerability that you haven't found yet.

It's simple to understand what they're saying if you read it as the ramblings of the world's largest sociopath.

[PercievingBalance]

34. Ok, whats the problem?

That they capitalized on the vulnerability to keep America safe or that they didn't make us aware of the vulnerability when they supposedly found out about it?

[neverforget]

35. Intelligence agencies would never lie to us.

[Kelvin Mace]

36. I never believe anything

until it has been officially denied.