4 ms·

Occam's Razor would say that the code was modified by a disgruntled employee just before leaving, no? Why is the jump being made to foreign governments?

by PakG1 11y ago

beambot 11y ago
Bypassing VPN encryption is only broadly useful if you can get access to packets in transit. Nation-state agencies are the only actors that probably already have such wiretaps. (As discussed here: https://www.imperialviolet.org/2015/12/19/juniper.html https://www.imperialviolet.org/2015/12/19/juniper.html)
- umanwizard 11y ago
  Non-nation-states could still get access to a reduced set of packets. I can sit next to you in a coffee shop with public wifi and see everything in the clear if I can decrypt your VPN. Also, maybe they never intended to use it, and just wanted to make their company look bad.
  - csandreasen 11y ago
    Is this guy sitting in a coffee shop with a 2U rackmount ScreenOS-based hardware VPN connected to his laptop? If not, this particular attack that the article is discussing wouldn't work.
- JaRail 11y ago
  I choose to blame Comcast -- with that backdoor in place, they have the resources to decrypt about... 300 gb/month per customer of traffic. Very interesting :D
colordrops 11y ago
Occam's Razor is heavily abused. It has a specific definition, and is typically used for scientific and metaphysical hypothesis [1], not human behavior, which is not a universal law. It is used as "a heuristic technique" and "is not considered an irrefutable principle of logic or a scientific result." Occam's Razor says nothing about what the actual truth is - it's just a tool use when choosing hypotheses to pursue. Even if we were to contort Occam's Razor into this use-case, there is countless evidence for state actors adding or requesting back doors to major routing hardware. [1] https://en.wikipedia.org/wiki/Occam%27s_razor https://en.wikipedia.org/wiki/Occam%27s_razor
- PakG1 11y ago
  As the thread has evolved, I am seeing better explanations of what happened, as well as better explanations of how the underlying technology worked. So I'll take back my idea on the disgruntled employee. I originally posted when I saw very few comments. That being said, I'd like to clarify thoughts on Occam's Razor. It's a bit off-topic, but I think it would be an enlightening discussion and don't expect it to go on long. The rest of the discussion here about OP is far more interesting. I just appreciate it if someone points out when my logic is flawed, so I hope you take it the same way. It is used as "a heuristic technique" and "is not considered an irrefutable principle of logic or a scientific result." Occam's Razor says nothing about what the actual truth is - it's just a tool use when choosing hypotheses to pursue. I don't think you and I disagree with anything here. I am surprised and curious as to why you might think I thought otherwise. Using your words instead of mine, I was curious why the investigation was so quickly pursuing the hypothesis of foreign governments hacking Juniper's engineering team to plant code. My question has now been answered as the thread evolved. I think that you understand Occam's Razor's letter and how it is used in academic circles, but you do not understand how its spirit still applies in non-academic circles. Occam's Razor simply states (quoting from the Wikipedia article): "Among competing hypotheses, the one with the fewest assumptions should be selected." Hypotheses are theories on how the world works. Detectives also have their hypotheses in their investigations on what happened in a crime. Infosec professionals also have their hypotheses on what makes a newfound piece of malware tick. Kepler, the FBI agent that chases serial killers, and the Symantec guys who discovered Stuxnet all share in common the dogged determination to figure out the truth by chasing facts. If you want to be a stickler on semantics and say that Occam’s Razor is referring to scientifically testable hypotheses, it seems a bit too dogmatic to say that we can’t scientifically test with experiments whether someone is the person that stuck the knife in another person, so Occam’s Razor should never be discussed. Good (I emphasize good) police work doesn’t make it necessary to design an experiment for that. Focusing on simpler ideas that fit the facts is more profitable than focusing on grandiose ideas, even if grandiose ideas also fit the facts, if both ideas explain the subject equally (equal quality of explanation being a key point of consideration, as discussed in the Wikipedia article). Those grandiose ideas aren't discarded because Occam's Razor is indeed only "a heuristic technique" and "is not considered an irrefutable principle of logic or a scientific result." If more facts arise that cause the simpler explanations to lose weight, the investigator changes course. I fear you are projecting too many assumptions onto people who cite Occam’s Razor, thinking that they’re taking Occam’s Razor to mean license to conclude an argument as finished when most people likely are not doing so. Certainly, I wasn’t. :)

Occam's Razor would say that the code was modified by a disgruntled employee just before leaving, no? Why is the jump being made to foreign governments?

by PakG1 11y ago

Occam's Razor would say that the code was modified by a disgruntled employee just before leaving, no? Why is the jump being made to foreign governments?

beambot 11y ago

Bypassing VPN encryption is only broadly useful if you can get access to packets in transit. Nation-state agencies are the only actors that probably already have such wiretaps. (As discussed here: https://www.imperialviolet.org/2015/12/19/juniper.html https://www.imperialviolet.org/2015/12/19/juniper.html)

umanwizard 11y ago
Non-nation-states could still get access to a reduced set of packets. I can sit next to you in a coffee shop with public wifi and see everything in the clear if I can decrypt your VPN. Also, maybe they never intended to use it, and just wanted to make their company look bad.
- csandreasen 11y ago
  Is this guy sitting in a coffee shop with a 2U rackmount ScreenOS-based hardware VPN connected to his laptop? If not, this particular attack that the article is discussing wouldn't work.
JaRail 11y ago
I choose to blame Comcast -- with that backdoor in place, they have the resources to decrypt about... 300 gb/month per customer of traffic. Very interesting :D

colordrops 11y ago

Occam's Razor is heavily abused. It has a specific definition, and is typically used for scientific and metaphysical hypothesis [1], not human behavior, which is not a universal law. It is used as "a heuristic technique" and "is not considered an irrefutable principle of logic or a scientific result." Occam's Razor says nothing about what the actual truth is - it's just a tool use when choosing hypotheses to pursue. Even if we were to contort Occam's Razor into this use-case, there is countless evidence for state actors adding or requesting back doors to major routing hardware. [1] https://en.wikipedia.org/wiki/Occam%27s_razor https://en.wikipedia.org/wiki/Occam%27s_razor

PakG1 11y ago
As the thread has evolved, I am seeing better explanations of what happened, as well as better explanations of how the underlying technology worked. So I'll take back my idea on the disgruntled employee. I originally posted when I saw very few comments. That being said, I'd like to clarify thoughts on Occam's Razor. It's a bit off-topic, but I think it would be an enlightening discussion and don't expect it to go on long. The rest of the discussion here about OP is far more interesting. I just appreciate it if someone points out when my logic is flawed, so I hope you take it the same way. It is used as "a heuristic technique" and "is not considered an irrefutable principle of logic or a scientific result." Occam's Razor says nothing about what the actual truth is - it's just a tool use when choosing hypotheses to pursue. I don't think you and I disagree with anything here. I am surprised and curious as to why you might think I thought otherwise. Using your words instead of mine, I was curious why the investigation was so quickly pursuing the hypothesis of foreign governments hacking Juniper's engineering team to plant code. My question has now been answered as the thread evolved. I think that you understand Occam's Razor's letter and how it is used in academic circles, but you do not understand how its spirit still applies in non-academic circles. Occam's Razor simply states (quoting from the Wikipedia article): "Among competing hypotheses, the one with the fewest assumptions should be selected." Hypotheses are theories on how the world works. Detectives also have their hypotheses in their investigations on what happened in a crime. Infosec professionals also have their hypotheses on what makes a newfound piece of malware tick. Kepler, the FBI agent that chases serial killers, and the Symantec guys who discovered Stuxnet all share in common the dogged determination to figure out the truth by chasing facts. If you want to be a stickler on semantics and say that Occam’s Razor is referring to scientifically testable hypotheses, it seems a bit too dogmatic to say that we can’t scientifically test with experiments whether someone is the person that stuck the knife in another person, so Occam’s Razor should never be discussed. Good (I emphasize good) police work doesn’t make it necessary to design an experiment for that. Focusing on simpler ideas that fit the facts is more profitable than focusing on grandiose ideas, even if grandiose ideas also fit the facts, if both ideas explain the subject equally (equal quality of explanation being a key point of consideration, as discussed in the Wikipedia article). Those grandiose ideas aren't discarded because Occam's Razor is indeed only "a heuristic technique" and "is not considered an irrefutable principle of logic or a scientific result." If more facts arise that cause the simpler explanations to lose weight, the investigator changes course. I fear you are projecting too many assumptions onto people who cite Occam’s Razor, thinking that they’re taking Occam’s Razor to mean license to conclude an argument as finished when most people likely are not doing so. Certainly, I wasn’t. :)