[securityaffairs] Heartbleed flaw was already exploited for cyber attacks by NSA

The US National Security Agency knew for at least two years about the Heartbleed flaw, and exploited it for cyber attacks according Bloomberg.

[securityaffairs] RSA is accused again to have helped NSA to weaken security products

A group of researchers from Johns Hopkins University discovered that a second NSA tool aggravate the RSA security software’s vulnerability.

[securityaffairs] How GCHQ and NSA spied on German citizens and global politics

GCHQ infiltrated German firms while NSA obtained a court order to spy on Germany and collected information about the chancellor in a special database.

[securityaffairs] NSA hacked Huawei network for cyber espionage

NSA leaked documents, analyzed by Der Spiegel and The Times, report that NSA has hacked Huawei network to demonstrate the link with Chinese PLA.

[net-security] NSA targets sys admins to breach computer networks

A newly analyzed document from Edward Snowden's trove show that the NSA collects personal and account information on system administrators and uses it to compromise their computers in order to access the networks they manage.

[infosecurity-magazine] NSA Collects the Whole Voice Conversation of an Entire Nation

It could, in fact, be at least five nations, with a sixth scheduled for inclusion soon. These revelations were published yesterday in a report based on Snowden leaks just after Edward Snowden himself warned the TED2014 Conference audience in Vancouver that there are more – and worse – revelations to come.

[huntonprivacyblog] NSA Appoints Chief Privacy Officer

POSTED ON JANUARY 30, 2014 BY HUNTON & WILLIAMS LLPMore Sharing Se

On January 29, 2014, the National Security Agency (“NSA”) announced that Rebecca Richards has been appointed to serve as the NSA’s new Civil Liberties and Privacy Officer. Ms. Richards, who previously worked as the Senior Director for Privacy Compliance at the Department of Homeland Security, will advise the NSA Director on civil liberties and privacy issues and implement reforms in those areas.

[computerweekly] NSA failed to detect Snowden’s unsophisticated insider attack

The National Security Agency (NSA) failed to detect the relatively unsophisticated data mining activities of whistleblower Edward Snowden, it has emerged.

Investigators have found Snowden used web crawlers to access and copy about 1.7 million documents, according to the New York Times (NYT).

NSA officials declined to say which web crawler Snowden had used, or whether he had written some of the software himself.The software is widely available and designed to search, index and back up a website, but was used by Snowden to harvest classified data.

The news has deepened concerns that Snowden was not discovered and stopped in the light of the fact that the NSA is responsible for defending sensitive US computer systems from cyber attack.

Snowden’s insider attack, by contrast, was hardly sophisticated and should have been easily detected, investigators said.

[latimes] Several cybersecurity initiatives lost after Snowden's NSA leaks

By Ken Dilanian

February 1, 2014, 6:51 p.m.

WASHINGTON — Early last year, as Edward Snowden was preparing to disclose classified documents he had purloined from National Security Agency computers in Hawaii, the NSA director, Gen. Keith Alexander, was gearing up to sell Congress and the public on a proposal for the NSA to defend private U.S. computer networks against cyber attacks.

Alexander wanted to use the NSA's powerful tools to scan Internet traffic for malicious software code. He said the NSA could kill the viruses and other digital threats without reading consumers' private emails, texts and Web searches.

The NSA normally protects military and other national security computer networks. Alexander also wanted authority to prevent hackers from penetrating U.S. banks, defense industries, telecommunications systems and other institutions to crash their networks or to steal intellectual property worth billions of dollars.

---

FOR THE RECORD:
National Security Agency: An article in the Feb. 2 Section A on the effects of Edward Snowden's leaks of National Security Agency secrets said the White House backed the Cyber Intelligence Sharing and Protection Act, a cybersecurity measure. The White House threatened to veto the proposed bill in April. —

---

But after Snowden, a contractor, began leaking NSA systems for spying in cyberspace that went public in June, Alexander's proposal was a political nonstarter, felled by distrust of his agency's fearsome surveillance powers in the seesawing national debate over privacy and national security.