Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Submission + - NSA said to have used Heartbleed bug for years (bloomberg.com)

grub writes: The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said.

The NSA’s decision to keep the bug secret in pursuit of national security interests threatens to renew the rancorous debate over the role of the government’s top computer experts.

Comment moderns EDUCATED STUPID on equality (Score 3, Interesting) 581

It seems like some of the less deep thinkers these days get confused by our societal value of equality.
When the founding fathers said said "all men are created equal", they meant that the government should treat everybody the same out of general fairness.
They didn't mean that Dr J and Albert Einstein have the same attributes.

Anyhow, you most likely won't be successful retraining most coal miners to write code.
But it's not much of a stretch for most coders, particularly brogrammers like Marky Z, to learn to shovel shit.

Comment Re:Whatever you may think ... (Score 5, Informative) 447


From the proof-of-concept page I mentioned above.

Conclusion

It is quite obvious in light of the recent revelations from Snowden that this weakness was introduced by purpose by the NSA. It is very elegant and leaks its complete internal state in only 32 bytes of output, which is very impressive knowing it takes 32 bytes of input as a seed.

Here is the Github repo for the PoC code.

This PRNG is not the NSA making a crypto system stronger ala DES, it's a backdoor.

Comment Re:Whatever you may think ... (Score 4, Informative) 447


RSA has denied having knowledge of the backdoor, says NSA tricked them, and has never denied the $10M payout. Some of Snowden's leaks mention it.
Reuters has a summary

proof-of-concept backdoor with a link to the github repo.

None of that is a smoking gun, but there is enough smoke to tell me there is a fire.

Comment Re:Whatever you may think ... (Score 5, Insightful) 447


Boy, if there's one thing that could ever kill Open Source it would be being held legally liable for a commit with a bug in it.

It burns me that RSA is not held liable for their $10M NSA backdoor in Dual_EC_DRBG PRNG. Customers should be flocking in droves but RSA gives enough swag at conferences that the suits don't care.

Your privacy sold off for $10M and some mouse pads.

Slashdot Top Deals

Always draw your curves, then plot your reading.

Working...