NSA denies that it exploited ‘Heartbleed’ vulnerability to spy on targets


By Rob Lever, AFP

WASHINGTON–The U.S. National Security Agency on Friday denied a report claiming it was aware of and even exploited the “Heartbleed” online security flaw to gather critical intelligence. The stern denial came amid growing panic among Internet users the world over about the newly exposed flaw, after a report by Bloomberg News said the spy agency decided to keep quiet about the matter and even used it to scoop up more data, including passwords. “NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report,” NSA spokeswoman Vanee Vines said in an email. “Reports that say otherwise are wrong.” OpenSSL is online-data scrambling software commonly used to protect passwords, credit card numbers and other data sent via the Internet. A White House official also denied that any U.S. agency was aware of the bug before it was revealed by security researchers earlier this month. “Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before April 2014 are wrong,” White House national security spokeswoman Caitlin Hayden said in a statement. “This administration takes seriously its responsibility to help maintain an open, interoperable, secure and reliable Internet.

“If the federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL.” ‘Part of NSA arsenal’ Bloomberg, citing two people said to be familiar with the matter, said the NSA was able to make Heartbleed part of its “arsenal” to obtain passwords and other data, without making public a vulnerability which could affect millions of Internet users. The report said the secretive intelligence agency has more than 1,000 experts devoted to ferreting out these kinds of flaws and found the Heartbleed glitch shortly after its introduction.