NSA Denies It Used 'Heartbleed' Bug to Gather Intelligence

The National Security Agency on Friday denied a report that it has been aware for years of the enormous 'Heartbleed' security flaw affecting millions of websites, but kept the information secret and used it for its own purposes.

Bloomberg, citing unidentified sources, reported Friday that the NSA knew about Heartbleed for two years before the public disclosure of the bug by security researchers last week.

'NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report. Reports that say otherwise are wrong,' the agency said in a statement to NBC News.

Heartbleed is a flaw in OpenSSL, a piece of code intended to create a secure connection between a server and Web browser - for example, between an online shop and customer. The bug allows an attacker to make the server surrender bits of information out of its memory that should not be accessible. What's more, the exploit leaves no trace.

By some estimates Heartbleed puts two-thirds of all websites at risk, and the ease of taking advantage of the bug means there's no reason to think any site could not have been targeted. That means everything from passwords to credit card numbers to closely-guarded industrial secrets might have been leaked over the last few years to hackers. And there's not a lot consumers can do until the sites fix the problem on their end.

The U.S. government on Friday warned banks and other businesses on Friday to be on alert for hackers seeking to steal data exposed by Heartbleed.

The Bloomberg report said the NSA, by exploiting Heartbleed, was able to obtain passwords and other basic data that are the building blocks of the sophisticated hacking operations at the core of its mission.

First published April 11 2014, 1:50 PM

Devin Coldewey

Devin Coldewey is a contributing writer at NBC News; he started his role in April of 2013. Coldewey is responsible for original reporting on a number of tech topics, such as photography, biotechnology, and Internet policy.Coldewey joined NBCNews.com from TechCrunch, where he was an editor covering a similarly wide variety of content and industries. His personal website is coldewey.cc.

... Expand Bio