Hackers claim to have compromised OpenSSL code

OpenSSL, the widely used cryptographic library repaired in early April, is being claimed to have been hacked, though security experts doubt the claim.

Written in a posting on Pastebin, a group of five hackers said they worked for two weeks to find the bug and developed code to exploit it. They are offering the hack for 2.5 bitcoins, or around $870.

The open-source OpenSSL code is used by millions of websites to create encrypted communications between client computers and servers. The hackers’ claim was met with immediate suspicion on Full Disclosure, a forum for discussing vulnerability reports.

In spite of playing a critical role in protecting communications, the OpenSSL Project has only one full-time employee. It also has a mere $2,000 in donations annually.

A group of technology companies and organizations, including Amazon Web Services, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, VMware and The Linux Foundation, are promoting the Core Infrastructure Initiative which is intended to generate funds for full-time developers on important open-source products.