NSA said to have used Heartbleed bug

WASHINGTON — The National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said.

The NSA’s decision to keep the bug secret in pursuit of national security interests threatens to renew the rancorous debate over the role of the government’s top computer experts.

Heartbleed appears to be one of the biggest glitches in the Internet’s history, a flaw in the basic security of as many as two-thirds of the world’s websites. Its discovery and the creation of a fix by researchers five days ago prompted consumers to change their passwords, the Canadian government to suspend electronic tax filing and computer companies including Cisco Systems Inc. to Juniper Networks Inc. to provide patches for their systems.

Putting the Heartbleed bug in its arsenal, the NSA was able to obtain passwords and other basic data that are the building blocks of the sophisticated hacking operations at the core of its mission, but at a cost. Millions of ordinary users were left vulnerable to attack from other nations’ intelligence arms and criminal hackers.

“It flies in the face of the agency’s comments that defense comes first,” said Jason Healey, director of the cyber statecraft initiative at the Atlantic Council and a former Air Force cyber officer. “They are going to be completely shredded by the computer security community for this.”

Vanee Vines, an NSA spokeswoman, declined to comment on the agency’s knowledge or use of the bug. Experts say the search for flaws is central to NSA’s mission, though the practice is controversial. A presidential board reviewing the NSA’s activities after Edward Snowden’s leaks recommended the agency halt the stockpiling of software vulnerabilities.

The NSA and other elite intelligence agencies devote millions of dollars to hunt for common software flaws that are critical to stealing data from secure computers. Open-source protocols like OpenSSL, where the flaw was found, are primary targets.

The Heartbleed flaw, introduced in early 2012 in a minor adjustment to the OpenSSL protocol, highlights one of the failings of open source software development.

While many Internet companies rely on the free code, its integrity depends on a small number of underfunded researchers who devote their energies to the projects.

In contrast, the NSA has more than 1,000 experts devoted to ferreting out such flaws using sophisticated analysis techniques, many of them classified. The agency found the Heartbeat glitch shortly after its introduction, according to one of the people familiar with the matter, and it became a basic part of the agency’s toolkit for stealing account passwords and other common tasks.

The NSA has faced nine months of withering criticism for the breadth of its spying, documented in a rolling series of leaks from Snowden, who was a former agency contractor.

The revelations have created a clearer picture of the two roles, sometimes contradictory, played by the U.S. government’s largest spy agency. The NSA protects the computers of the government and critical industry from cyberattacks, while gathering troves of intelligence attacking the computers of others, including terrorist organizations, nuclear smugglers and other governments.

Ordinary Internet users are ill-served by the arrangement because serious flaws are not fixed, exposing their data to domestic and international spy organizations and criminals, said John Pescatore, director of emerging security trends at the SANS Institute, a Bethesda, Md.-based cyber-security training organization.

“If you combine the two into one government agency, which mission wins?” asked Pescatore, who formerly worked in security for the NSA and the Secret Service. “Invariably when this has happened over time, the offensive mission wins.”

When researchers uncovered the Heartbleed bug hiding in plain sight and made it public on April 7, it underscored an uncomfortable truth: The public may be placing too much trust in software and hardware developers to insure the security of our most sensitive transactions.

“We’ve never seen any quite like this,” said Michael Sutton, vice president of security research at Zscaler, a San Jose, Calif.-based security firm. “Not only is a huge portion of the Internet impacted, but the damage that can be done, and with relative ease, is immense.”

The potential stems from a flaw in the protocol used to encrypt communications between users and websites protected by OpenSSL, making those supposedly secure sites an open book. The damage could be done with relatively simple scans, so that millions of machines could be hit by a single attacker.

Questions remain about whether anyone other than the U.S. government might have exploited the flaw before the public disclosure. Sophisticated intelligence agencies in other countries are one possibility.

If criminals found the flaw before a fix was published this week, they could have scooped up troves of passwords for online bank accounts, e-commerce sites, and e-mail accounts across the world.

Evidence of that is so far lacking, and it’s possible that cybercriminals missed the potential in the same way security professionals did, suggested Tal Klein, vice president of marketing at Adallom, in Menlo Park, Calif.

The fact that the vulnerability existed in the transmission of ordinary data – even if it’s the kind of data the vast majority of users are concerned about – may have been a factor in the decision by NSA officials to keep it a secret, said James Lewis, a cybersecurity senior fellow at the Center for Strategic and International Studies.

“They actually have a process when they find this stuff that goes all the way up to the director” of the agency, Lewis said. “They look at how likely it is that other guys have found it and might be using it, and they look at what’s the risk to the country.”

Lewis said the NSA has a range of options, including exploiting the vulnerability to gain intelligence for a short period of time and then discreetly contacting software makers or open source researchers to fix it.

The SSL protocol has a history of security problems, Lewis said, and is not the primary form of protection governments and others use to transmit highly sensitive information.

“I knew hackers who could break it nearly 15 years ago,” Lewis said of the SSL protocol.

That may not soothe the millions of users who were left vulnerable for so long.

Following the leaks about NSA’s electronic spying, President Barack Obama convened a panel to review the country’s surveillance activities and suggest reforms. Among the dozens of changes put forward was a recommendation that the NSA quickly move to fix software flaws rather that exploit them, and that they be used only in “rare instances” and for short periods of time.

Currently, the NSA has a trove of thousands of such vulnerabilities that can be used to breach some of the world’s most sensitive computers, according to a person briefed on the matter. Intelligence chiefs have said the country’s ability to spot terrorist threats and understand the intent of hostile leaders would be vastly diminished if their use were prohibited.

Talk to us

More in Local News

This photo provided by OceanGate Expeditions shows a submersible vessel named Titan used to visit the wreckage site of the Titanic. In a race against the clock on the high seas, an expanding international armada of ships and airplanes searched Tuesday, June 20, 2023, for the submersible that vanished in the North Atlantic while taking five people down to the wreck of the Titanic. (OceanGate Expeditions via AP)
A new movie based on OceanGate’s Titan submersible tragedy is in the works: ‘Salvaged’

MindRiot announced the film, a fictional project titled “Salvaged,” on Friday.

Craig Hess (Snohomish County Sheriff’s Office)
Sultan’s new police chief has 22 years in law enforcement

Craig Hess was sworn in Sep. 14. The Long Island-born cop was a first-responder on 9/11. He also served as Gold Bar police chief.

Cars move across Edgewater Bridge toward Everett on Tuesday, Sept. 26, 2023, in Washington. (Olivia Vanni / The Herald)
Edgewater Bridge redo linking Everett, Mukilteo delayed until mid-2024

The project, now with an estimated cost of $27 million, will detour West Mukilteo Boulevard foot and car traffic for a year.

Lynn Deeken, the Dean of Arts, Learning Resources & Pathways at EvCC, addresses a large gathering during the ribbon cutting ceremony of the new Cascade Learning Center on Thursday, Sept. 28, 2023, at Everett Community College in Everett, Washington. (Ryan Berry / The Herald)
New EvCC learning resource center opens to students, public

Planners of the Everett Community College building hope it will encourage students to use on-campus tutoring resources.

Everett Police Chief Dan Templeman announces his retirement after 31 years of service at the Everett City Council meeting on Wednesday, Sept. 27, 2023 in Everett, Washington. (Olivia Vanni / The Herald)
Everett police chief to retire at the end of October

Chief Dan Templeman announced his retirement at Wednesday’s City Council meeting. He has been chief for nine years.

Boeing employees watch the KC-46 Pegasus delivery event  from the air stairs at Boeing on Thursday, Jan. 24, 2019 in Everett, Wa. (Andy Bronson / The Herald)
Boeing’s iconic Everett factory tour to resume in October

After a three-year hiatus, tours of the Boeing Company’s enormous jet assembly plant are back at Paine Field.

A memorial for a 15-year-old shot and killed last week is set up at a bus stop along Harrison Road on Wednesday, Sept. 13, 2023, in Everett, Washington. (Ryan Berry / The Herald)
Teen boy identified in fatal shooting at Everett bus stop

Bryan Tamayo-Franco, 15, was shot at a Hardeson Road bus stop earlier this month. Police arrested two suspects.

Lynnwood
Woman killed in crash on Highway 99 in Lynnwood

Police closed off Highway 99 between 188th Street SW and 196th Street SW while they investigated.

Mike Bredstrand, who is trying to get back his job with Lake Stevens Public Works, stands in front of the department’s building on Wednesday, Sept. 27, 2023, in Lake Stevens, Washington. Bredstrand believes his firing in July was an unwarranted act of revenge by the city. (Ryan Berry / The Herald)
Lake Stevens worker was fired after getting court order against boss

The city has reportedly spent nearly $60,000 on attorney and arbitration fees related to Mike Bredstrand, who wants his job back.

Chap Grubb, founder and CEO of second-hand outdoor gear store Rerouted, stands inside his new storefront on Thursday, Sept. 21, 2023, in Gold Bar, Washington. Rerouted began as an entirely online shop that connected buyers and sellers of used gear.  (Ryan Berry / The Herald)
Used outdoor gear shop Rerouted finds a niche in Gold Bar

Seeking to keep good outdoor gear out of landfills, an online reselling business has put down roots in Gold Bar.

Naval Station Everett. (Chuck Taylor / Herald file)
Everett man sentenced to 6 years for cyberstalking ex-wife

Christopher Crawford, 42, was found guilty of sending intimate photos of his ex-wife to adult websites and to colleagues in the Navy.

Snohomish County Executive Dave Somers speaks to the crowd during an opening ceremony at the new PAE2 Amazon Fulfillment Center on Thursday, Sept. 14, 2023, in Arlington, Washington. (Ryan Berry / The Herald)
Snohomish County executive pitches $1.66B budget

Snohomish County Executive Dave Somers announced his proposed budget Tuesday afternoon. Public comment is slated to begin Oct. 10.