4 ms·

"Unauthorized" seems strangely vague - does that suggest something was released without code review, or that an attacker actually managed to get something into

"Unauthorized" seems strangely vague - does that suggest something was released without code review, or that an attacker actually managed to get something into their codebase?

tptacek 11y ago
It pretty strongly suggests the latter: that the code was malicious.
- bch 11y ago
  I don't know their organization/development structure, but couldn't it also mean (for example) an overzealous intern committed where not authorized, and it passed into a production release? It's early to tell, and hard to tease from Junipers message. On the one hand, one might say they'd like to see more info from Juniper, but on the other, courageous of Juniper to be as forthcoming as they are.
  - marshray 11y ago
    If it had been simply an overzealous intern, wouldn't they have just announced that like a normal security bug?
    - bch 11y ago
      I guess the question is: "why qualify the bug at all?" and work backwards. If it's a bad actor that did this, did they qualify it because the effects are so heinous they don't want to take responsibility for the code (but admit to being hacked)? If it were an intern, they are still disavowing the code, but admitting something slipped through audit cracks. What's worse, or what's the motivation (and cost) for qualifying the flaw? I don't know the answer, just putting out a question. [Edit: lots of swype typos]
mpeg 11y ago
Lots of network devices don't do any kind of real validation of the updates they get from a remote server, beyond using SSL which only checks that the origin is correct. A while ago I accidentally stumbled upon the file servers that served updates for a major router manufacturer. The host vulnerability itself was reported and fixed, but I doubt they told their clients (the router company) anything. In that case, anyone who found the vulnerability could have modified the binary blobs, I wonder if this is a similar case.
- earlz 11y ago
  heh I found such a thing once for modems, wasn't writeable, but for a device that's not suppose to have public firmware files, it was interesting. Included old versions and probably debug versions and internal docs too, but that stuff scares me too much to look at more than the initial file listing that happened to be indexed by google heh
- jlgaddis 11y ago
  It sounds much more like someone made their own "contribution" to the source code. For JunOS, updates are digitally signed (and verified when installing) so any modifications would have had to occur before the images were built, but I really can't remember if ScreenOS updates are signed or not (it's been a long time).
redbeard0x0a 11y ago
It seems that an exploit in ScreenOS that is this large and knowing some of the things the NSA has been up to over the past few years. The coincidences are a little scary. Looking at the leaked catalog of NSA Exploits, you find that the NSA had a backdoor for Juniper equipment called FEEDTHROUGH: > In the case of Juniper, the name of this particular digital lock pick is "FEEDTROUGH." This malware burrows into Juniper firewalls and makes it possible to smuggle other NSA programs into mainframe computers. (http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html http://www.spiegel.de/international/world/catalog-reveals-ns...)

"Unauthorized" seems strangely vague - does that suggest something was released without code review, or that an attacker actually managed to get something into their codebase?

tptacek 11y ago

It pretty strongly suggests the latter: that the code was malicious.

bch 11y ago
I don't know their organization/development structure, but couldn't it also mean (for example) an overzealous intern committed where not authorized, and it passed into a production release? It's early to tell, and hard to tease from Junipers message. On the one hand, one might say they'd like to see more info from Juniper, but on the other, courageous of Juniper to be as forthcoming as they are.
- marshray 11y ago
  If it had been simply an overzealous intern, wouldn't they have just announced that like a normal security bug?
  - bch 11y ago
    I guess the question is: "why qualify the bug at all?" and work backwards. If it's a bad actor that did this, did they qualify it because the effects are so heinous they don't want to take responsibility for the code (but admit to being hacked)? If it were an intern, they are still disavowing the code, but admitting something slipped through audit cracks. What's worse, or what's the motivation (and cost) for qualifying the flaw? I don't know the answer, just putting out a question. [Edit: lots of swype typos]

mpeg 11y ago

Lots of network devices don't do any kind of real validation of the updates they get from a remote server, beyond using SSL which only checks that the origin is correct. A while ago I accidentally stumbled upon the file servers that served updates for a major router manufacturer. The host vulnerability itself was reported and fixed, but I doubt they told their clients (the router company) anything. In that case, anyone who found the vulnerability could have modified the binary blobs, I wonder if this is a similar case.

earlz 11y ago
heh I found such a thing once for modems, wasn't writeable, but for a device that's not suppose to have public firmware files, it was interesting. Included old versions and probably debug versions and internal docs too, but that stuff scares me too much to look at more than the initial file listing that happened to be indexed by google heh
jlgaddis 11y ago
It sounds much more like someone made their own "contribution" to the source code. For JunOS, updates are digitally signed (and verified when installing) so any modifications would have had to occur before the images were built, but I really can't remember if ScreenOS updates are signed or not (it's been a long time).

redbeard0x0a 11y ago

It seems that an exploit in ScreenOS that is this large and knowing some of the things the NSA has been up to over the past few years. The coincidences are a little scary. Looking at the leaked catalog of NSA Exploits, you find that the NSA had a backdoor for Juniper equipment called FEEDTHROUGH: > In the case of Juniper, the name of this particular digital lock pick is "FEEDTROUGH." This malware burrows into Juniper firewalls and makes it possible to smuggle other NSA programs into mainframe computers. (http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html http://www.spiegel.de/international/world/catalog-reveals-ns...)