5 ms·

I would love to know what the commits in the source code look like for these. Author, message, date. How did they bypass the review process? Was the process

I would love to know what the commits in the source code look like for these. Author, message, date. How did they bypass the review process? Was the process socially engineered, or was the repo hacked directly? What will the new process be to ensure this doesn't happen again? This has implications for the process at most companies.

discardorama 11y ago
We would all love to see how it went down. But I'd bet good money that Juniper will not reveal what happened. Sometimes I wonder how difficult is it for $TLA to send their employees off into the world (on their payroll), as sleeper coders, to be activated whenever a small piece of code needs to be inserted in the right place. You don't even need too many; just a handful would be sufficient.
- johnchristopher 11y ago
  But are sleepers agents reliable enough ? Considering they would be living in peace in a modern and comfortable country, wouldn't they hesitate to act when activated?
  - discardorama 11y ago
    What if the sleeper "agent" is employed by the NSA?
  - zrth 11y ago
    Sleeper agents should be reliable enough, considered that they (the in the long past "recruited") want to have their family and loved ones safe -- it would really be a pity if some stupid accident happened to any of them on their way home... Sounds morbid, yes, but rest assured, with enough "motivation" financial options and "moral flexibility" you can always motivate others, to do as demanded.
    - johnchristopher 11y ago
      Ah, (you're) right. My game on these matters isn't top-notch.
rogerbinns 11y ago
Has there been any disclosure of when these changes were made? NetScreen was a Juniper acquisition, so they could date back quite a while to a frenetic startup environment and misguided/malicious employees in those days. Disclosure: I also worked for Juniper by being in a startup acquisition. I don't remember any audits of our existing code.
- yuhong 11y ago
  I think all evidence shows that it has been probably there since at least 2012.
  - scq 11y ago
    It's present in ScreenOS 6.2, released in 2008 - and probably in even earlier versions too.
    - rogerbinns 11y ago
      Juniper acquired NetScreen in 2004, with NetScreen itself only just acquiring Neoteris. I'd love to know just how far back this issue goes!
michaelt 11y ago
How did they bypass the review process? You wouldn't have to - you could wait for an opportunity to slip it into a huge, mundane change. For example, changing the repository from Mercurial to Git. Splitting or combining two repositories. Moving lots of files between directories. Running an autoformatter over the entire codebase. Something like that. I'd wager there aren't many reviewers with the patience and attentiveness to spot 1 evil change among 1000 trivial changes.

discardorama 11y ago

We would all love to see how it went down. But I'd bet good money that Juniper will not reveal what happened. Sometimes I wonder how difficult is it for $TLA to send their employees off into the world (on their payroll), as sleeper coders, to be activated whenever a small piece of code needs to be inserted in the right place. You don't even need too many; just a handful would be sufficient.

johnchristopher 11y ago
But are sleepers agents reliable enough ? Considering they would be living in peace in a modern and comfortable country, wouldn't they hesitate to act when activated?
- discardorama 11y ago
  What if the sleeper "agent" is employed by the NSA?
- zrth 11y ago
  Sleeper agents should be reliable enough, considered that they (the in the long past "recruited") want to have their family and loved ones safe -- it would really be a pity if some stupid accident happened to any of them on their way home... Sounds morbid, yes, but rest assured, with enough "motivation" financial options and "moral flexibility" you can always motivate others, to do as demanded.
  - johnchristopher 11y ago
    Ah, (you're) right. My game on these matters isn't top-notch.

rogerbinns 11y ago

Has there been any disclosure of when these changes were made? NetScreen was a Juniper acquisition, so they could date back quite a while to a frenetic startup environment and misguided/malicious employees in those days. Disclosure: I also worked for Juniper by being in a startup acquisition. I don't remember any audits of our existing code.

yuhong 11y ago
I think all evidence shows that it has been probably there since at least 2012.
- scq 11y ago
  It's present in ScreenOS 6.2, released in 2008 - and probably in even earlier versions too.
  - rogerbinns 11y ago
    Juniper acquired NetScreen in 2004, with NetScreen itself only just acquiring Neoteris. I'd love to know just how far back this issue goes!

michaelt 11y ago

How did they bypass the review process? You wouldn't have to - you could wait for an opportunity to slip it into a huge, mundane change. For example, changing the repository from Mercurial to Git. Splitting or combining two repositories. Moving lots of files between directories. Running an autoformatter over the entire codebase. Something like that. I'd wager there aren't many reviewers with the patience and attentiveness to spot 1 evil change among 1000 trivial changes.