Slashdot Mirror
'Unauthorized Code' In Juniper Firewalls Could Decrypt VPN Traffic (arstechnica.com)
m2pc writes: Ars Technica reports that Juniper Networks firewalls have been discovered to include "unauthorized code" inserted into their ScreenOS software. Juniper has has published an advisory addressing the matter, with instructions to patch the affected devices.
From the Ars article: "NetScreen firewalls using ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 are affected and require immediate patching. Release notes published by Juniper suggest the earliest vulnerable versions date back to at least 2012 and possibly earlier. ... The first flaw allows unauthorized remote administrative access to an affected device over SSH or telnet. Exploits can lead to complete compromise. 'The second issue may allow a knowledgeable attacker who can monitor VPN traffic to decrypt that traffic,' the advisory said." The rogue code was discovered during a recent internal source code review conducted by Juniper.
From the Ars article: "NetScreen firewalls using ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 are affected and require immediate patching. Release notes published by Juniper suggest the earliest vulnerable versions date back to at least 2012 and possibly earlier. ... The first flaw allows unauthorized remote administrative access to an affected device over SSH or telnet. Exploits can lead to complete compromise. 'The second issue may allow a knowledgeable attacker who can monitor VPN traffic to decrypt that traffic,' the advisory said." The rogue code was discovered during a recent internal source code review conducted by Juniper.
says Cisco . . . . .
I'm not entirely certain why the government is bothering to raise such a fuss about strong crypto. ( Other than to make it look like they have no options ) While no evidence exists that Big Brother is responsible for it, they are the most likely suspects. Not much of a need to break the crypto itself when you can install a bypass of some sort into the mix.
I wonder how much it costs to coerce a programmer type to insert a few bits of code into your project.
This is EXACTLY a vulnerability that Snowden leak suggested. Juniper and ScreenOS by name.
Thanks for disclosing this, Juniper, but why didn't you know about it three years ago? What else is hiding in your products? This is quite different from a software flaw introduced by a mere human. This is indicative of a poorly managed, haphazard approach to managing software development.
People still use netscreens? Oh wait we do... Luckily our code is too old to be exploited. Yay?
Did the backdoor let just anybody in, or did you have to have some key info to get in?
Best possible bad behavior: Adding a secure backdoor.
Worse behavior: Using a zero day instead of trying to get it fixed.
Worse still: Adding a backdoor that is a zero day for others to find.
It will come down to the point where network vendors will need to spend more of their time verifying their code hasn't been tampered with. It wont be enough just to have change control, but we will need to have change locking and verification. Exploits come from many directions, but is it worth the cost to fight both internal and external agents.
This compromise hits the bottom line directly. It will effect purchase decisions, just like having Cisco products intercepted and tampered with by the NSA effected their sales. I guess it's now a matter of who do we want listening in... (State actors...US, China, etc, Corporate actors... Google, Apple, Dell, or Network Providers... Verizon, AT&T , Level 3, Comcast...) Unfortunately it's never just one party attempting to listen in, or glom on....
The phrase "Unauthorized code" smells of weasel wording. If the malware was injected afterwards(either through a network attack or a physical intercept-and-tamper, then the manufacturer could reasonably call it "unauthorized" or "malware" or similar; but if they shipped it, how much more 'authorized' do you get?
Perhaps "mistakenly authorized after slipping past scrutiny" or "authorized by one or more of our employees who is also a spook", or "we fucked up"; but not really "unauthorized". Were I a customer, I'd want a much, much, better account of how exactly this 'unauthorized code' came to be present, when, and who knew about it, who didn't, and why or why not.
So are Juniper one of the companies that provided source code to the NSA? We can pretend its Russian hackers or Chinese hackers or whatever, but the reality is NSA has the history of doing this, probably had the source code and maybe even the assistance of employees.
Because the extra code would have to be in the SOURCE CONTROL system to survive every incremental upgrade, and so will have some user name associated with it to track it.
And this reminds me of the other big revelation, that the UK Spooks did mass surveillance and lied to UK Parliament to cover it up. Which included planting malware in a slightly cruder way:
http://www.theregister.co.uk/2015/12/16/big_brother_born_ntac_gchq_mi5_mass_surveillance_data_slurping/
"PRESTON, which collects about four million intercepted phone calls a year, has also recently been used to plant malware on iPhones, according to disclosures by former NSA contractor Edward Snowden. The phones were then targetted for MI5 "implants" (malware), authorised by a ministerial warrant."
You may also remember GCHQ 'Smurfs' software for mobile phones.
Dreamy Smurf. turns phones on when they are off.
Tracker Smurf turns on the GPS
Nosey Smurf turns on the microphone and listens in
I wonder how Dreamy Smurf can do something that is a system protected function without the help of Google or Apple. It seems remarkably easy to get around the security.
Is this the project codename FEEDTHROUGH that was revealed to the public by Snowden 2 years ago?
If my vim/emacs or any other text editor is compromised [or why not compromise the file-system itself..so it will serve "good" file for reading and supply the souped-up version only to the compiler], how will I even spot the issue?
..when you can put in wrong code directly in the OS.. they should've gone ahead and put it right inside the file-system/editor/display-system.
Reminds the story of login program vulnerability put inside C compiler by Ritchie.
Come on
No, we must deal with the biggest threat first.
Every commit I make at work is required to have at least one peer review and its' recommended to have two and we are not selling security-related software.
I've never heard of this company, but this revelation speaks volumes to their poor development strategy. Maybe they fell in love with buzzwords like Agile or Waterfall or whatever without realizing that proper processes like peer reviews have nothing to do with these buzzwords. Either way, they can not be trusted for letting this happen. Either they do not review their own code on a regular basis, or parts of management are corrupt for letting this happen. Either way, probably time to stop doing business with them.
I'm god, but it's a bit of a drag really...
So, they were sitting around the table at the code review meeting and nobody knew which government asked for THAT back door?
Configuration management? Don't they have it? Did they also remove any log entries showing the changes?
I smell disgruntled employee (or a paid off one).
Is the backdoor now officially authorized?
A while back we migrated from a Juniper to a Sonicwall NSA(Network Security Appliance).
I can just imagine the laughter generated at Sonicwall and at the NSA when this product line was announced...
We play the game with the bravery of being out of range
Maybe they want to ADD a backdoor?
signed,
nsa
Well, with a telnet daemon running, who needs a backdoor?
An undercover (national || foreign national) government agent infiltrated our company and inserted a 'backdoor' into our firewall code
..or..
A member of a (criminal || terrorist) organization infiltrated our company and inserted a 'backdoor' into our firewall code
..or..
A (national || foreign national || criminal) organization (paid off || extorted) a Juniper Networks employee to insert a 'backdoor' into our firewall code
Take your pick from any of the above theories, since 'unauthorized' is about as thinly-veiled a euphemism as you can get.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Assuming that NSA did that, can this even be legal? I mean, to sabotage an entire line of products of an American company by an American government agency? It's like if FDA went and injected all MacDonald's happy meals with cadmium.
One thing is to pay them, as they did with RSA, and another is to actually break their code. Or maybe Juniper was paid, but subscription has lapsed?
Saw stacks and stacks of Juniper devices at the location in Nashville where Google is building out their Fiber datacenter.
Saw stacks of Juniper devices at the location in Nashville where Google is building out their Fiber datacenter.
http://imgur.com/OzHk9Y6
http://imgur.com/FQ4htyr
Because if they had that, then all code would be authorized and signed off on. At least they found the problem, but this is really amateur-level.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This is why you should not rely on a VPN or any single layer solely as your entire security solution. Multiple layers of encryption and AAA and best practices are required. Its all about making it harder for the bad guys. No solution is fool proof.