Re: heartbleed OpenSSL bug CVE-2014-0160

[Michal Zalewski <lcamtuf () coredump cx>]

> http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html

Uh huh. And here's a fairly unequivocal rebuttal:
http://icontherecord.tumblr.com/post/82416436703/statement-on-bloomberg-news-story-that-nsa-knew

There's not a whole lot of wiggle room. It's possible that the
statement is an outright lie, but as much as I never expected to be
saying that, I'm more inclined to side with the NSA than with "unnamed
sources" in online journalism. The latter has gone kind of bonkers
post-Snowden, mixing legitimate (and sometimes very concerning)
revelations with a remarkable amount of drivel.

> Don't you guys feel that in the last 12 months, there are very many bugs
> related to SSL showing up ?

Um, probably not?

/mz

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/