Slashdot Mirror
The Juniper VPN Backdoor: Buggy Code With a Dose of Shady NSA Crypto (csoonline.com)
itwbennett writes: Security researchers and crypto experts now believe that a combination of likely malicious third-party modifications and Juniper's own crypto failures are responsible for the recently disclosed backdoor in Juniper NetScreen firewalls. 'To sum up, some hacker or group of hackers noticed an existing backdoor in the Juniper software, which may have been intentional or unintentional — you be the judge!,' Matthew Green, a cryptographer and assistant professor at Johns Hopkins University wrote in a blog post. 'They then piggybacked on top of it to build a backdoor of their own, something they were able to do because all of the hard work had already been done for them. The end result was a period in which someone — maybe a foreign government — was able to decrypt Juniper traffic in the U.S. and around the world. And all because Juniper had already paved the road.'
Never attribute to a National Security Letter what can adequately be explained by incompetence. Or was it something else?
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
This isn't a "backdoor," it's an officially sanctioned terrorist detector.
Good job NSA!
The demands for "Government Backdoor to All Encryption" need to stop! Installing a back door makes it available for _EVERYONE_, not just some agency which may or may not have a warrant. Not that we _will_ see it stop, just that it should.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
This isn't the first excellent post by Matthew Green. His other on ECC was also informative and scary.
Juniper equipment manages industrial control systems, (like the kind used in nuclear power plants) and we rely on encryption for every part of our online experience - not to mention classified data that presumably protects Americans. The passive collection of VPN data Mr. Green suggests probably happened, and the active exploitation of equipment Snowden revealed by the NSA is a much bigger story than collecting phone records ever was.
The infosec community making fun of Hillary for suggesting a manhattan project for encryption is funny, but this underlines a serious lack of understanding by too many people in high places.
Judging from what i've read so far it is pretty obvious that the original Dual_EC_DRBG-based backdoor was placed there quite intentionally. Juniper has a lot to answer for.
The US government does that with suitcases. You now get to buy suitcases that have a three digit combination lock, as well as a special DHS lock that bypasses that combination lock.
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
But who's to say this isn't the cover story for the "Government VPN Encryption" program where a foreign entity managed to "steal" the backdoor password so now everyone has to patch.
Bet we hear similar things from cisco in the coming weeks/months.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
Crypto experts should have understood this from the 1920's on over every generation of telco and network as a standard given to "other" nations to connect with.
Every generation has its crypto subverted by 5 eye nations due to location (global capture) and raw computing power to "collect it all".
US network equipment designers had to fit in domestic production lines around what was Communications Assistance for Law Enforcement Act (CALEA).
Every big brand device as exported, shipped, designed, upgraded, sold is trap door, back door ready.
All other nations can do now is design domestically, build and code locally. Suffer the heat, cooling, power, cpu limits and know the domestic code their nation is using is now running on their own hardware. Get out of any import bids for upgrades with a security clause and start designing domestically.
Allowing, demanding a nation to import any trap door, back door ready "export grade" hardware is really getting strange given all the public crypto news.
Domestic spying is now "Benign Information Gathering"
"malicious third-party modifications and Juniper's own crypto failures are responsible for the recently disclosed backdoor in Juniper NetScreen firewalls."
Given todays computing model, where clicking on a link opens up a two-way connection to a server and executes remote code on your computer, the firewall is next to useless.
Now you just have to hope that the compiler hasn't got a backdoor generator built into it (the Ken Thompson hack)...