The NSA is so concerned about the security of each of our data that it issued a statement with suggestions on how to avoid information leaks due to the OpenSSL Heartbleed bug.
It is truly very ironic that now we all know that the intelligence service monitors what moves on the internet and steals information.
So the NSA, which is concerned about our security, states that we must upgrade the TLS/DTLS clients on the servers we use to the latest version of OpenSSL (1.0.1g) or run a recompile on the old OpenSSL version with the option “DOPENSSL_NO_HEARTBEATS.”
Continuing very seriously to mock us, NSA reports that many operating systems and clients in the server software run OpenSSL, which means they are vulnerable to Heartbleed. In this case, the secret service suggests contacting the software vendor to determine if there is a risk and request an updated version that will fix the issue.
“For any systems that are affected by this vulnerability, use TLS/DTLS, and have exposure to Internet connectivity for potential exploitation of this vulnerability, revoke and reissue certificates and other credentials utilized on those systems after applying the update,” says the NSΑ guide.
There is suspicion that the NSA knew about Heartbleed for years and kept it secret, in order to exploit the vulnerability. After the latest publications that revealed the vulnerability, the US secret service deemed it appropriate to inform us, thus keeping the accolades if nothing else.
