full-disclosure - Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

Open Source and information security mailing list archives

Message-ID: <CALx_OUBD_SVH45d3swPMwtEtdP8sa2Mzq35oHz5rtijMHi1OXA@mail.gmail.com>
Date: Fri, 11 Apr 2014 16:26:16 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: Joerg Mertin <smurphy@...sys.org>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] heartbleed OpenSSL bug CVE-2014-0160

> http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html

Uh huh. And here's a fairly unequivocal rebuttal:
http://icontherecord.tumblr.com/post/82416436703/statement-on-bloomberg-news-story-that-nsa-knew

There's not a whole lot of wiggle room. It's possible that the
statement is an outright lie, but as much as I never expected to be
saying that, I'm more inclined to side with the NSA than with "unnamed
sources" in online journalism. The latter has gone kind of bonkers
post-Snowden, mixing legitimate (and sometimes very concerning)
revelations with a remarkable amount of drivel.

> Don't you guys feel that in the last 12 months, there are very many bugs
> related to SSL showing up ?

Um, probably not?

/mz

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives