Analytics
4/15/2014
02:42 PM
50%
50%

White House Details Zero-Day Bug Policy

NSA denies prior knowledge of the Heartbleed vulnerability, but the White House reserves the right to withhold zero-day exploit information in some cases involving security or law enforcement.

10 Ways To Fight Digital Theft & Fraud
10 Ways To Fight Digital Theft & Fraud
(Click image for larger view and slideshow.)

The White House and National Security Agency have strongly denied reports that the NSA had known about the Heartbleed vulnerability in OpenSSL for years and was actively exploiting it for intelligence-gathering purposes.

Those allegations appeared Friday in a Bloomberg News report -- citing unnamed sources -- claiming the NSA kept secret details about the Heartbleed vulnerability for at least two years. The vulnerability (a.k.a. CVE-2014-0160), which can be used to spoof and steal encrypted information from millions of vulnerable websites, was recently discovered and made public by Google engineer Neel Mehta and Finnish security firm Codenomicon.

But the NSA -- via Twitter -- and the Obama administration quickly disputed the Bloomberg report. "NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private sector cybersecurity report," read a statement released Friday by the Office of the Director of National Intelligence (ODNI). "Reports that say otherwise are wrong." The ODNI also noted that the federal government relies on OpenSSL to secure government websites, and claimed that if any agency -- including the NSA -- had previously discovered the vulnerability, "it would have been disclosed to the community responsible for OpenSSL."

[How does Heartbleed affect your enterprise's internal network? Read Heartbleed's Intranet & VPN Connection.]

The discovery of the Heartbleed bug has triggered questions about how fast government agencies should come clean if and when they discover a never-before-seen bug. On that front, Richard Clarke, a member of a presidential panel that reviewed the NSA's practices and issued specific recommendations to the White House, told Bloomberg News that three weeks ago, President Obama told government agencies that -- in most cases -- if they discover a zero-day vulnerability, the information will be publicly disclosed.

The ODNI statement issued Friday echoed that instruction, saying that going forward, agencies would be "biased toward responsibly disclosing such vulnerabilities" using a predefined inter-agency review known as the Vulnerabilities Equities Process.

But the Obama administration also reserved the right to withhold zero-day vulnerability information for cases where "there is a clear national security or law enforcement need."

Some privacy experts questioned the leeway that the White House left intelligence agencies such as the NSA. "The policy has a loophole so big that you could drive a truck through it," Christopher Soghoian, principal technologist at the American Civil Liberties Union, told Bloomberg News. On the other hand, he said, the fact that the president is even discussing zero-day policies represents "a really big shift."

But some security experts have argued that, by definition, it's not the job of the NSA -- or any other country's intelligence service -- to publicly share information about zero-day threats. Errata Security CEO Robert David Graham pointed out that the existence of the Heartbleed bug was hardly the NSA's fault, and if the agency did decline to warn OpenSSL or anyone else about the flaw, that was well within its remit. "Finding such bugs and keeping them quiet is wholly within the NSA's mission statement," he said in a blog post. "Their job is to spy on foreigners and keep state secrets safe. Generally, state secrets aren't on machines exposed to the Internet, so keeping the bug secret had no impact on that."

Furthermore, the NSA may not have needed Heartbleed. Documents leaked by Edward Snowden, for example, revealed the existence of a top-secret NSA program code-named BULLRUN, which was designed to defeat specific encryption protocols, including SSL. A recent Bloomberg News report, furthermore, cited two unnamed sources who claimed that the NSA has at least two techniques for defeating SSL.

The discovery of the OpenSSL vulnerability has led millions of consumers to change their online passwords and prompted businesses to put costly fixes in place. The flaw exists in versions 1.0.1 and 1.0.2 beta of OpenSSL, which is an open-source implementation of the SSL and TLS protocols that provide websites with cryptographic capabilities. In recent days, both researchers and attackers have demonstrated how the vulnerability can be easily -- if not immediately -- exploited to recover a site's private keys.

As of last week, Netcraft reported that about 500 million websites are vulnerable to the Heartbleed bug. By Monday, only about 30,000 vulnerable sites had reportedly changed their digital certificates; the rest remain vulnerable to Heartbleed.

Cyber-criminals wielding APTs have plenty of innovative techniques to evade network and endpoint defenses. It's scary stuff, and ignorance is definitely not bliss. How to fight back? Think security that's distributed, stratified, and adaptive. Read our Advanced Attacks Demand New Defenses report today (free registration required).

Mathew Schwartz served as the InformationWeek information security reporter from 2010 until mid-2014. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ScottW834
50%
50%
ScottW834,
User Rank: Apprentice
4/16/2014 | 8:52:04 AM
Credibility and the Civil Cyber War
The US Government has lost its credibility.  What reason is there to trust them?  That said, what reason was there ever to trust them.  Patriotism in this country demands distrust of those that govern.

There is a World Cyber War going on.  It is many faceted.  It includes what is rapidly becoming a Civil Cyber War against governments that have been exposed for snooping on their own citizens.  It will be a long time if ever before the private sector will truly trust a partnership with government in regards to technology and security.  Ultimately, I think that is fine as a check and ballance.
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Moderator
4/15/2014 | 9:10:25 PM
Don't expect the NSA to help or even come clean
It wasn't the NSA's responsibility to find the HeartBleed bug, and if they did find it, I wouldn't believe their statements that they didn't use it. For them to say otherwise would tip off various parties that their servers are no longer safe to use, while the NSA would prefer they go on using them as before.vvvvv
securityaffairs01
50%
50%
securityaffairs01,
User Rank: Apprentice
4/15/2014 | 6:52:10 PM
What's new?
We cannot be surprised. NSA, as any other intelligence has used, and will use in the future exploits to gather sensitive information and foreign government secrets.

What we are seeing is just the tip of the iceberg ... we are in the middle of a cyber war, but people ignore it.

 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-2086
Published: 2015-02-26
Cross-site scripting (XSS) vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title.

CVE-2015-2087
Published: 2015-02-26
Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via unspecified vectors.

CVE-2015-2088
Published: 2015-02-26
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

CVE-2015-2089
Published: 2015-02-26
Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (...

CVE-2015-2090
Published: 2015-02-26
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.