10 ms·
Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors
- danso 11y agoI'm looking at Juniper's news page [1] and its Twitter feed [2]...it doesn't give me a lot of confidence that this security breach or even its (apparently inadequate) patch doesn't even a news item or a Tweet. [1] http://newsroom.juniper.net/ http://newsroom.juniper.net/ [2] https://twitter.com/JuniperNetworks/with_replies https://twitter.com/JuniperNetworks/with_replies
- jjp 11y agoWas discussed yesterday on this thread https://news.ycombinator.com/item?id=10754917 https://news.ycombinator.com/item?id=10754917 which points to the proactive announcement Juniper made
- SyneRyder 11y agoThere's also http://advisory.juniper.net/ http://advisory.juniper.net/ with further details on each security notice.
- campuscodi 11y agoIt's not the first time when HN stories are doubled with Wired articles. I had one blatantly replaced. This site has a preference for fear-mongering reporting... I mean Wired.
- jlgaddis 11y agoAt least their notice went out on a Thursday, instead of waiting until late Friday evening or, worse, next Friday evening (by which time a large percentage of the engineers managing these boxes will be on vacation).
- blazespin 11y agoThe big story here is not that Juniper is weak but rather that these types of attacks are succeeding. If Juniper has fallen, god knows what else is vulnerable.
- huuu 11y agoIt's sad but events like this one make me turn away from Internet. I started using Signal because I don't want people seeing the messages I post. But in the end it's only trust that makes me think Signal is safe to use. A lot of people also trusted Juniper. But that trust is gone. And not only for Juniper. What about other brands? We don't know.
- mjs 11y agoYou're still secure if you use https. If neither your computer nor the host you're connecting to has been tampered with, then you're safe irrespective of what's happening between.
- nickodell 11y agoWell, what if the host you're connecting to is a Juniper firewall?
- toyg 11y agoYeah, because illegitimate / spoofed certificates will never happen...
- andreyf 11y agoI think we're well on our way to a point where certificates can be mostly trusted. Of course certs can be stolen, but I would bet that "spoofed" certificates will soon be an occurrence of the past.
- Ao7bei3s 11y agoWith certificate transparency, at least we'll know about it - afterwards, at least.
- marcosdumay 11y agoWell, afterwards, if the attack stops (software does not need to stop) in a timeframe short enough for your computer to no clear its history.
- Buge 11y agoWow that nation state is stupid. They embedded the backdoor password right into it. Clearly they should have embedded the hash of the password instead. Then it would be unbreakable and no other party would be able to use the backdoor. Hashing passwords is extremely basic security practice.
- omni 11y agoWhen you're trying to do something secretly, you run into a new tradeoff: doing it the right way vs. doing it in such a way that it doesn't draw attention to itself. It might have been the case that hashing it would have been too flashy.
- relkor 11y agoI would imagine it would hook into the existing code that is hashing the passwords... Which suggests that they are not in fact hashing the user inputs and are relying on the client to do that for them.
- coldtea 11y ago>They embedded the backdoor password right into it Or you know, that's just one obvious backdoor they put in, to divert from the other 2-3 non-obvious they have.
- Buge 11y agoBut one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others. For example the DUAL_EC backdoor could only be exploited by the NSA. With this backdoor, now China and everyday criminals can also use it. I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations.
- coldtea 11y ago>But one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others. Which is an empty statement when it comes to security principles. If you've placed a backdoor (and some are blatantly obvious if you look for it, like some SSL issues), then others can use it too. Most backdoors are not of the "we have an encrypted password only we know" variety, but of the purposeful hole to exploit. >I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations. Except if the idea is to monitor the local population, and you do not care that much if others monitor them too.
- acd 11y agoSome corporations will not know about the issue or ignore it and thus will get hacked by the backdoor. Now this backdoor does not only benefit those who implanted it, it will benefit the opposing side who can hack using it.
- hyperdunc 11y agoThe honeymoon is over. The Internet is now a hostile environment. We cannot assume good conduct from any party of reasonable size and should assume deception from anything that isn't fully open source and vocal about it. It sucks to assume the worst...
- ageek123 11y agoIt would appear that the "party of reasonable size" here is China or Russia, not a corporation.
- hyperdunc 11y agoI'm not sure that matters. Any powerful entity wrapped in secrecy is suspect, whether they're a nation state or a corporation. We, the users, are always the victims - dependant on the infrastructure or services that have been compromised.
- static_noise 11y agoI don't really get why you specifically mention these two countries. It could be because your government is at war with them but that would be speculation. The problem goes much deeper. It could be any "larger" corporation or government or other entity having enough manpower. It could even be parts of a corporation or government entity. However which way you put it, a program of which you don't have access to the source cannot be trusted.
- lifty 11y agoCan you please explain how you reached that conclusion? What made you exclude US and UK?
- dandrews 11y agoParent is probably taking the CNN article at face value.
- eeZi 11y agoNow? The code was introduced in 2008.
- stickfigure 11y agoI'm confused. Are these accidental vulnerabilities or deliberate backdoors? If deliberate, why is there speculation about who might have installed this "secret code"? Do they have version control? Is there a specific human attached to the relevant commits? Serious question.
- andreyf 11y agoAnd a good one. They were definitely deliberate, but the other details are not public.
- jubes 11y agoIf this wasn't an intentional backdoor it raises the question, what source control methods were being used and are they secure? Has Juniper been compromised on a larger scale?
- andreyf 11y agoThat's a good question, too. I'm sure people are asking it and many others like it internally, a well. On the outside, I think this is yet another reason to use git, which, if I recall correctly, is designed to make attacks on commit history significantly more difficult than they are with SVN and CVS.
- enlightenedfool 11y agoThey might know the person, but not necessarily their affiliation. They might want to investigate before they divulge. If it's a US person, it takes time or would never be divulged.
- hyperdunc 11y agoThis is a very important point. Are the backdoor(s) traceable to a specific event or individual? How far up the company hierarchy does the rot go? Whatever the answer, it is insufficient. We are relying on hardware and software that is opaque at the network level, and therefore open to this sort of manipulation.
- peterkelly 11y agoI like CNN's take on the story: http://edition.cnn.com/2015/12/18/politics/juniper-networks-us-government-security-hack/ http://edition.cnn.com/2015/12/18/politics/juniper-networks-... Obviously it must be either Russia or China - NSA couldn't possibly be responsible ;)
- level09 11y agoIt can't be NSA agents who caught intercepting network gear from Cisco Systems as it was being shipped to a customer (as revealed by snowden) it is highly unlikely they infected juniper networks as well. </sarcasm>
- meowface 11y agoTo play devil's advocate, it is a big leap going from backdooring a specific device sent to a specific person you may by monitoring, to backdooring every one of those devices. Not that I would put it past NSA, though.
- rtpg 11y agoI don't disagree that they might have the intent to, but it's possible they didn't have the capability to. Much like the difference between forcing sites to hand over SSL certs and breaking SSL, there's a gulf between compromising hardware that you have physical access to and compromising the software stack at the source. In this case I wouldn't be surprised if that turned out to be the narrative, but the "NSA can accomplish anything" position is a narrative that plays into their favor.
- coldtea 11y ago>Much like the difference between forcing sites to hand over SSL certs and breaking SSL, there's a gulf between compromising hardware that you have physical access to and compromising the software stack at the source. You know that they could have their own programmers working there, or just approach, bribe or blackmail, an existing programmer to compromise the software (e.g. one found with child porn on his HD).
- y04nn 11y agoDon't gouvernements can check the source code? like for Windows?
- mcintyre1994 11y agoIt's an interesting thought. If they checked and spotted this would they report it to defend against the attacker that injected it, or would they just pocket the master password and use it themselves?
- Kristine1975 11y agoMaybe both: They found a second backdoor, reported one and kept the other. This makes them trustworthy in the eyes of Juniper, while still netting them a backdoor.
- marcosdumay 11y agoWell, at the specific case of Windows, Microsoft ships something they say is the source code of it. But nobody is allowed to compile it, and can not do so in practice, because they don't ship the building environment.
- kabdib 11y agoI'll bet you ten dollars there are more backdoors, better hidden than the ones they found. Say, with Underhanded C style coding. An additional ten bucks says that Cisco and the top handful of consumer appliances also contain such backdoors. I hope the folks at Juniper are checking their toolchains, build machines and repositories for signs of similar attack. Of course, enough time has elapsed that they may need to establish a cleanroom for their code. Hoo boy.
- jacquesm 11y ago> I hope the folks at Juniper are checking their toolchains, build machines and repositories for signs of similar attack. I hope they figure out who planted it there and that they change their hiring/code review policies to make sure that such a thing can not happen again. Firewalls should be tamper-proof to the point where they simply refuse to operate at all if the code has been messed with after it leaves the premises, the absence of such tamper proofing is already a problem and should be taken quite serious.
- kbenson 11y agoWhich is DRM, right? Which is fine, but it needs to be DRM in control of the owner, not the supplying company. There's all sorts of evils in the world to worry about, so we shouldn't be too quick to get away from one that we run into the arms of another. There are, not coincidentally, parallels with terrorism and the security state.
- kabdib 11y agoI would love an attestation system. For instance, the firewalls around a store's credit card info (even if this data isn't stored, but tokenized, it's still damned useful) should sing like a canary if their configuration or firmware are hacked. Attestation is sort of like DRM with policies that you decide. Note that many of these devices have significant complexity in hardware. Lots of things that state-level actors can do to your hardware, on the order of: - see packet starting with a known signature - over-write the rest of that packet with interesting stuff, and transmit Something at this level would be really hard to find.
- acd 11y agoThis also highlights why it would be better to use opensource firewalls such as Openbsd instead of proprietary ones! If you care about your security then you need to be able to inspect the code that protects your assets. Distributed open source firewall vs propritary firewall with backdoors.
- raesene9 11y agoOf course the idea that open source software in general, and firewalls in specific are better than closed source ones relies on people actually having the skills and time necessary to conduct a decent audit. Some of the very large security bugs found in open source software which were present in that code for years, indicate that this is not commonly done. And that was just bugs as opposed to actual backdoors which would likely be harder to find if inserted competently. So whilst in theory you are correct, I'm not so sure you are in practice.
- jordigh 11y agoWith visible source code, at least the security bugs are actual bugs instead of deliberate attacks on the users. Psychologically, people are less likely to commit antisocial acts if they think that they are being watched. So, if nothing else, having visible source code helps reducing some attacks. The more popular a particular project is, the more watched they will feel. I therefore still trust OpenVPN a lot more than I trust Juniper. Every one of its patches goes through a public code review: https://community.openvpn.net/openvpn/wiki/DeveloperDocumentation#Developmentprocesses https://community.openvpn.net/openvpn/wiki/DeveloperDocument... http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?viewmonth=201512&viewday=11 http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?view...
- JeremyNT 11y agoIndeed, for those of us not taking the time (or lacking the expertise) to audit code ourselves, this is all ultimately appeal to authority. If anything, the advantages of open source here are more about open development processes and being able to know just who is the gate keeper. As an example, if you use OpenBSD, you have reasonable assurances that Theo will do a good job, because he has earned his reputation. Juniper? Who really knows what goes on internally? How are people allocated and shuffled around? It's a black box. Ultimately I'd put more trust in OpenBSD than in Juniper because of this, but I'm still making a leap of faith. And OpenBSD is an extreme example of how much trust a project can earn; a vast majority of open source code is not held to such scrutiny.
- blisterpeanuts 11y ago"I am shocked—shocked—to find that gambling is going on in here!" --from "Casablanca" I'd be shocked to learn that there are no back doors in routing equipment. Having that kind of control is just too appealing to the most powerful players -- the NSA, China, perhaps Russia. One hopes that people who care about the privacy of their communications are not relying on the routers for encryption. I would encrypt end-to-end. Even if the spooks are capturing the data, let them work for their cleartext. Of course, we have to use algorithms that aren't compromised, either. Annoying and disturbing. And they can't claim it's needed to stop terrorism, either. The U.S. anti-terrorism apparatus didn't spot an obviously dangerous couple in San Bernardino, even after one of them posted jihadist goals on her stream. They didn't stop the Tsarnaev brothers from bombing the Boston Marathon even after the Russians phoned to warn us about them. Idiots.
- merpnderp 11y agoWish I could up vote this more. The government has nearly nothing to show for all their surveillance and yet they keep asking for more.
- jkestner 11y agoWell, it's because if they had more powers they could be more effective, right? This line of logic ends only when the people stop asking for perfect security.
- pyvpx 11y agoI read from a reliable source I cannot immediately recall that she in fact did not post anything jihadist or even inflammatory on any social media account of hers. are you repeating a convenient falsehood or am I? in other words -- do you have a source that verified she in fact posted jihadist anything, anywhere?
- jdp23 11y agoExcellent point. The whole episode is very instructive. On Sunday the New York Times quoted "law enforcement sources" as saying that she had made postings on her stream. The story got a huge amount of coverage and even came up during Tuesday's Republican debate. On Wednesday, FBI Director Comey described the reporting as "grabled" and clarified that no, it was just private messages -- and the Times (and others) rewrote their stories to reflect it. But you can't unring a bell; most people's opinion, and even more importantly their emotional responses, are based on the original story. Erik Wemple covers this well in the Washington Post [1] Times' "public editor" Margeret Sullivan's looks at it as well [2], noting that two of the reporters also incorrectly reported that Hillary Clinton was the target of a criminal investigation. [1] https://www.washingtonpost.com/blogs/erik-wemple/wp/2015/12/16/the-fbi-just-blasted-reporting-on-the-san-bernardino-killings/ https://www.washingtonpost.com/blogs/erik-wemple/wp/2015/12/... [2] http://publiceditor.blogs.nytimes.com/2015/12/18/new-york-times-san-bernardino-correction-margaret-sullivan-public-editor/ http://publiceditor.blogs.nytimes.com/2015/12/18/new-york-ti...
- gtirloni 11y agoI think these is a good example for people that complained about OpenBSD refusing to use cloud servers for their infrastructure. Point being security at this level shouldn't be taken lightly. Juniper must have a ton of security measures in place and they end up with this.
- mtgx 11y agoJuniper is using Dual EC....are you kidding me? Now I have zero doubt this is Juniper's fault because of its cooperation with NSA to keep backdoors in its systems. If I remember correctly even tptacek was claiming initially that "Dual EC is not so bad...not that many companies use it anyway, because they would be stupid to use a 1000x slower algorithm". Yeah, except some of the biggest networking equipment makers in the world who do use it, and who sell products to many other small and large companies, too. Quite a bit of an attack surface for the NSA. The point was always that Dual_EC should've never become a NIST standard, no matter how "bad it was and that probably nobody would use it anyway". It was made a standard for a reason by the NSA, to convince at least some of the big companies to use it. And they succeeded in that. We can only hope that the good people who work in standard bodies will never allow something like that to happen again, because in the end backdoors always end up being used for "evil", whether by the initial creators or by someone else who finds them later.
- tptacek 11y agoIf you're going to use quotation marks when referring to something I said, you should actually quote me, instead of making stuff up.
- tptacek 11y agoJust a quick note that 'lawnchair_larry has me dead to rights on this one. I conceded awhile ago that Dual EC was a crypto backdoor (before BULLRUN and the antics that were uncovered with RSA and with the European standards, I had suggested, as some other crypto people had, that Dual EC was too hamfisted and obvious to be a crypto backdoor). But I've maintained since then that virtually nobody uses Dual EC, so its impact --- while clearly malign! --- is probably limited. Nope. ScreenOS apparently (I'm not 100% sure, but that seems to be the way the wind is blowing) uses it to key VPN connections! FULLY CONCEDED. The immediate known practical impact of Dual EC is, if that's true, enormous. The weird thing about this particular backdoor is that the adversary seems to have modified the Dual EC parameters. Dual EC is an RNG with an embedded public key, where an adversary with the private key can "decrypt" the random bytes it generates to recover its state and rewind/fast forward it. This backdoor appears to swap out the public key, which is something NSA has no interest in doing. My money is that this is the work of GCHQ, the world's most unhinged signals intelligence agency, and our partners in peace.
- jdp23 11y agoKudos to you for the public admission. And yeah, I have to admit that when I saw this I thought of the Marshall McLuhan scene from Annie Hall with you in the role of the NYU professor.
- tptacek 11y agoIt's pretty jaw-dropping. The news (still unconfirmed, but really looking that way) that ScreenOS keyed sessions from DualEC is probably bigger than the news that ScreenOS had an unauthorized backdoor.
- fabulist 11y ago"Instead of using the NIST recommended curve points [ScreenOS] uses self-generated basis points..." [0] The way I read this statement is that each device generates its own set of points. If this is the case, I don't see how it would work as a crypto backdoor. If by "self-generated" they mean generated by Juniper once, well, thats fishy. [0] http://kb.juniper.net/InfoCenter/index?page=content&id=KB28205 http://kb.juniper.net/InfoCenter/index?page=content&id=KB282... Edited to add: Upon further research, the latter possibility seems more likely.
- hdmoore 11y agoIf anyone is interested, you can find the unpacked firmware and some rough diffs online at https://github.com/hdm/juniper-cve-2015-7755/ https://github.com/hdm/juniper-cve-2015-7755/