The Internet community was shocked by the disclosure of the Heartbleed flaw, the vulnerability affects OpenSSL library and allows an attacker to reveal up to 64kB of memory to a connected client or server.
Hundreds of thousands websites and networking equipment on the Internet were vulnerable for years to Heartbleed bug, allowing target violation and passwords grabbing.
Many experts speculated that the Heartbleed flaw was already exploited for cyber attacks in the recent months, the first suspects are related state-sponsored hackers, of course first thoughts goes to NSA and its TAO cyber unit.
While the U.S. Department of Homeland Security issued a warning about Heartbleed, Bloomberg reported that the National Security Agency was one of the intelligence agencies aware of the Heartbleed flaw and it was actively exploiting the vulnerability for the last two years.
“While there have not been any reported attacks or malicious incidents involving this particular vulnerability confirmed at this time, it is still possible that malicious actors in cyberspace could exploit un-patched systems. ” states the US DHS related to the possibility that bad actors could have exploited Heartbleed flaw.
“The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said.” reported Bloomberg on Heartbleed.
On many occasions we have read about cyber capabilities of the NSA, and in particular of its abilities to break encryption processes, some experts also hypothesized the used of Quantum Computing
Just a few minutes ago the NSA in a tweet denied to have used the Hearthbleed flaw in the past.
Waiting for another disturbing truth, all the website administrators are invited to apply the patch already available for OpenSSL library.
(Security Affairs – Heartbleed flaw, NSA)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.