# Poll: Did NSA Know About and Use Heartbleed Bug? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [April 12, 2014, 1:38am UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908 "2014-04-12T01:38:02Z")\ **Posts on this page:** 15\ **Page:** 2
**Author:** ![buddha\_david](https://avatars.discourse-cdn.com/v4/letter/b/ee7513/32.png) [@buddha\_david](https://boards.straightdope.com/u/buddha_david)\ **Post date:** [April 13, 2014, 2:00am UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/21 "2014-04-13T02:00:35Z")
> [@Measure\_for\_Measure](#): > > And yet we know the NSA didn’t have access to this bug: their official statement proves that, up to a point. All they did was issue a statement denying all knowledge. And Bill Clinton didn’t have sexual relations with “that woman” either. ---
**Author:** ![kaylasdad99](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kaylasdad99/32/3398_2.png) [@kaylasdad99](https://boards.straightdope.com/u/kaylasdad99)\ **Post date:** [April 13, 2014, 3:08am UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/22 "2014-04-13T03:08:21Z")
I don’t really _get_ the Heartbleed thing, on a technical level. Is the NSA exposed to any vulnerability from it? ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [April 13, 2014, 4:57am UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/23 "2014-04-13T04:57:52Z")
> [@kaylasdad99](#): > > I don’t really _get_ the Heartbleed thing, on a technical level. Is the NSA exposed to any vulnerability from it? The nature of the bug is explained in [this xkcd cartoon](http://xkcd.com/1354/). > [@buddha\_david](#): > > All they did was issue a statement denying all knowledge. And Bill Clinton didn’t have sexual relations with “that woman” either. I believe everything I read. More seriously, if their statement is accurate this is a major intelligence failure by a multibillion dollar agency. The Snowden papers reveal that they had an active interest in OpenSSL, so if they didn’t know of this bug they really should have. I’ll leave it to the reader to apply Occam’s Razor. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [April 13, 2014, 12:30pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/24 "2014-04-13T12:30:58Z")
> [@tellyworth](#): > > That’s not necessarily true. If it was widely exploited before the partial disclosure in April, chances are someone will turn up evidence of it. The University of Michigan has [checked their logs](https://zmap.io/heartbleed/) back to November 2013, and the first sign of scans turned up in April, from Chinese IPs. This is my take on it. People will be checking logs and tracking down IP addresses. If the NSA was using the bug, there will be tell-tale signs in logs. (I wonder if the NSA has hacked machines in China it can use as probes to throw off trackers? Hmm.) Of course, even better would be the situation if there was a government body keeping extensive logs of Internet traffic. Searching thru those logs would be easy for such a body. No doubt they’d helpfully tell us what they found. 😉 ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [April 13, 2014, 7:22pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/25 "2014-04-13T19:22:55Z")
Yeah, what we need is a governmental agency in charge of security. But what we would call it? _::Think, think::_ > [@Measure\_for\_Measure](#): > > AFAIK, OpenSSL was an all-volunteer effort: it had no employees. Actually they have 1 full time employee: “Since OpenSSL is established to prevent hacker theft with internet data, it seems to be an important endeavor; yet and still, you wouldn’t recognize this right away. There are only eleven people currently that work in OpenSSL: 46-year-old British cryptographer Dr. Stephen Henson, volunteer Geoffrey Thorpe, two other British volunteers, a German developer, and a few others. Stephen Henson is the only full-time employee on the OpenSSL project. What started as a project committed to data encryption has now become standard on two-thirds of all websites on the Internet.” [http://www.inferse.com/14435/heartbleed-bug-openssl-everything-need-know/](http://www.inferse.com/14435/heartbleed-bug-openssl-everything-need-know/) I suspect that the NSA has more than 11 employees studying OpenSSL. ---
**Author:** ![Mr\_Quatro](https://avatars.discourse-cdn.com/v4/letter/m/bc8723/32.png) [@Mr\_Quatro](https://boards.straightdope.com/u/Mr_Quatro)\ **Post date:** [April 13, 2014, 7:30pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/26 "2014-04-13T19:30:15Z")
If the NSA knew about it … why didn’t that tattle tell that took off to Russia tell us ahead of time? ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [April 13, 2014, 7:46pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/27 "2014-04-13T19:46:28Z")
> [@Mr\_Quatro](#): > > If the NSA knew about it … why didn’t that tattle tell that took off to Russia tell us ahead of time? Actually Snowden did IIRC, at least on a general level. There were related stories on encryption. While encryption codes are very safe the _implementation_ of them is a matter for speculation. The possibility of sabotage by intelligence agencies on OpenSSL has been discussed. Ditto for the version provided by Microsoft. (Brrrrrrr) It’s also interesting the way the modern mind works. OpenSSL was used by numerous financial service companies and web platforms which arguably did not conduct adequate due diligence. Shouldn’t the Conference Board have had something to say about this? Yet big biz gets a free pass while the NSA receives brickbats. The NSA, you see, is part of the guvment. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [April 13, 2014, 11:10pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/28 "2014-04-13T23:10:13Z")
> [@Mr\_Quatro](#): > > If the NSA knew about it … why didn’t that tattle tell that took off to Russia tell us ahead of time? [Today’s NYT has a decent article on the subject](http://www.nytimes.com/2014/04/13/us/politics/obama-lets-nsa-exploit-some-internet-flaws-officials-say.html). There is no evidence that the N.S.A. had any role in creating Heartbleed, or even that it made use of it. When the White House denied prior knowledge of Heartbleed on Friday afternoon, it appeared to be the first time that the N.S.A. had ever said whether a particular flaw in the Internet was — or was not — in the secret library it keeps at Fort Meade, Md., the headquarters of the agency and Cyber Command. But documents released by Edward J. Snowden, the former N.S.A. contractor, make it clear that two years before Heartbleed became known, the N.S.A. was looking at ways to accomplish exactly what the flaw did by accident. A program code-named Bullrun… was part of a decade-long effort to crack or circumvent encryption on the web. The documents do not make clear how well it succeeded, but it may well have been more effective than exploiting Heartbleed would be at enabling access to secret data. The article discusses the Obama administration’s weighing of policy options considering the extent to which the NSA should create or expose zero day exploits. There’s been a fair amount of such internal review subsequent to the Snowden revelations. ---
**Author:** ![buddha\_david](https://avatars.discourse-cdn.com/v4/letter/b/ee7513/32.png) [@buddha\_david](https://boards.straightdope.com/u/buddha_david)\ **Post date:** [April 14, 2014, 2:17am UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/29 "2014-04-14T02:17:07Z")
> [@Measure\_for\_Measure](#): > > Yet big biz gets a free pass while the NSA receives brickbats. The NSA, you see, is part of the guvment. “Free pass” – such a charming use of the word, to describe a gov’t that hands out up to [$700 billion with zero strings attached,](http://en.wikipedia.org/wiki/Emergency_Economic_Stabilization_Act_of_2008) to the very banks who crashed our economy in the first place! :mad: > [@Measure\_for\_Measure](#): > > But documents released by Edward J. Snowden, the former N.S.A. contractor, make it clear that two years before Heartbleed became known, the N.S.A. was looking at ways to accomplish exactly what the flaw did by accident. A program code-named Bullrun… was part of a decade-long effort to crack or circumvent encryption on the web. The documents do not make clear how well it succeeded, but it may well have been more effective than exploiting Heartbleed would be at enabling access to secret data. It should be kept in mind that Snowden’s leaks are nearly a year old, and his access to “sensitive NSA material” lasted only from early 2009 to April 2012. ([Cite.](http://en.wikipedia.org/wiki/Edward_snowden#Career)) The OpenSSL exploit has only existed for a year or two, so it’s reasonable to assume that Snowden never knew it existed. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [April 14, 2014, 2:24pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/30 "2014-04-14T14:24:29Z")
If the agency is actually innocent this time, they’re still hosed because they’ve put their own credibility so far into the toilet. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [April 14, 2014, 2:35pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/31 "2014-04-14T14:35:39Z")
> [@Gagundathar](#): > > I voted yes because if they didn’t know they sure as heck should have. The NSA employs some of the brightest crackers on the planet. This was an open source flaw. It would astound me if the NSA didn’t know about it. They don’t even have to ‘sneak in’ and get the source. It is there to be read. If they don’t run emulators on their servers of all of the common combinations of SSL, then they aren’t who I think they are. The underlying problem is an institutional conflict of interest created by having security (e.g. discovering and fixing vulnerabilities) and surveillance (e.g. discovering and exploiting vulnerabilities) under one roof. ---
**Author:** ![Mr\_Quatro](https://avatars.discourse-cdn.com/v4/letter/m/bc8723/32.png) [@Mr\_Quatro](https://boards.straightdope.com/u/Mr_Quatro)\ **Post date:** [April 14, 2014, 5:41pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/32 "2014-04-14T17:41:13Z")
So if I heard correctly a tech type person discovered this loophole and when he discovered it no one had yet taken advantage of the loophole. Is this just talking points? One more question what if someone with a large research facility had of know about this backdoor into people in the banking and investing industries offering access to company email’s and private company data information … Would the profit from such information be unlimited? ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [April 18, 2014, 3:51pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/33 "2014-04-18T15:51:52Z")
The problem is that there’s no way to tell after the fact whether the bug was used to leak sensitive data. ---
**Author:** ![gotpasswords](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@gotpasswords](https://boards.straightdope.com/u/gotpasswords)\ **Post date:** [April 18, 2014, 7:01pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/34 "2014-04-18T19:01:46Z")
[QUOTE=TriPolar] I don’t think the NSA is that good at hacking… [/QUOTE] Go take a look at what their Tailored Access Operations group has been doing over the past 15 or so years. They’re quite good at hacking. Scary good. Did the NSA start actively targeting specific systems as soon as the vulnerability was announced? I’d bet real money on that. I’m also willing to bet they were not involved in creating it. If they wrote Heartbleed, an encrypted email service called Lavabit would probably still be in business. They knew Edward Snowden was using it, so they desperately wanted to get in. Lavabit said “Uh-uh!” then revoked its keys and shut down last August rather than allow government access. Another encrypted email service called Silent Circle pre-emptively shut down and destroyed its servers after seeing the government’s efforts at getting access to Lavabit’s customer mail. ---
**Author:** ![buddha\_david](https://avatars.discourse-cdn.com/v4/letter/b/ee7513/32.png) [@buddha\_david](https://boards.straightdope.com/u/buddha_david)\ **Post date:** [April 18, 2014, 8:47pm UTC](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908/35 "2014-04-18T20:47:35Z")
> [@gotpasswords](#): > > I’m also willing to bet they were not involved in creating it. [Here’s an interview](http://www.theguardian.com/technology/2014/apr/11/heartbleed-developer-error-regrets-oversight) with the OpenSSL developer who fessed up to accidentally creating the error. Awesome reply/username combo, btw. 🆒 [Previous page](https://boards.straightdope.com/t/poll-did-nsa-know-about-and-use-heartbleed-bug/685908.md?page=1)