4 ms·

You can telnet or ssh to a Netscreen device, specify a valid username, and the backdoor password <<< %s(un='%s') = %u. If the device is vulnerable, you should r

by _jomo 11y ago

You can telnet or ssh to a Netscreen device, specify a valid username, and the backdoor password <<< %s(un='%s') = %u. If the device is vulnerable, you should receive an interactive shell with the highest privileges.

deleted 11y ago
[deleted]
- ghshephard 11y ago
  From the post: On December 18th, 2015 Juniper issued an advisory indicating that they had discovered unauthorized code in the ScreenOS software that powers their Netscreen firewalls. This advisory covered two distinct issues; a backdoor in the VPN implementation that allows a passive eavesdropper to decrypt traffic and a second backdoor that allows an attacker to bypass authentication in the SSH and Telnet daemons. Shortly after Juniper posted the advisory, an employee of FoxIT stated that they were able to identify the backdoor password in six hours. A quick Shodan search identified approximately 26,000 internet-facing Netscreen devices with SSH open. Given the severity of this issue, we decided to investigate. Did you read that paragraph (It's the first one)? I think the downvoting occured because it didn't even appear that you clicked on the article. Presumably anybody reading HN on a regular basis would have had little difficulty understanding the content of that paragraph.
- biot 11y ago
  The article already states: > This password allows an attacker to bypass authentication > through SSH and Telnet, as long as they know a valid > username. If you want to test this issue by hand, telnet or > ssh to a Netscreen device, specify a valid username, and > the backdoor password. If the device is vulnerable, you > should receive an interactive shell with the highest > privileges. The fact that you thanked _jomo for explaining something that effectively quotes almost verbatim what the article tells you indicates you probably didn't bother to read the article. Like with asking help on various forums, it's generally appreciated (or expected, depending on the community) that you do some homework yourself to understand things, state your current understanding, and then ask for confirmation or clarification if your understanding is incorrect. Saying "ELI5 please" comes across as intellectual laziness on your part. If you haven't made any effort to understand an article in plain English (it's no scientific paper we're discussing) then why should others make that effort for you?

by _jomo 11y ago

deleted 11y ago

[deleted]

ghshephard 11y ago
From the post: On December 18th, 2015 Juniper issued an advisory indicating that they had discovered unauthorized code in the ScreenOS software that powers their Netscreen firewalls. This advisory covered two distinct issues; a backdoor in the VPN implementation that allows a passive eavesdropper to decrypt traffic and a second backdoor that allows an attacker to bypass authentication in the SSH and Telnet daemons. Shortly after Juniper posted the advisory, an employee of FoxIT stated that they were able to identify the backdoor password in six hours. A quick Shodan search identified approximately 26,000 internet-facing Netscreen devices with SSH open. Given the severity of this issue, we decided to investigate. Did you read that paragraph (It's the first one)? I think the downvoting occured because it didn't even appear that you clicked on the article. Presumably anybody reading HN on a regular basis would have had little difficulty understanding the content of that paragraph.
biot 11y ago
The article already states: > This password allows an attacker to bypass authentication > through SSH and Telnet, as long as they know a valid > username. If you want to test this issue by hand, telnet or > ssh to a Netscreen device, specify a valid username, and > the backdoor password. If the device is vulnerable, you > should receive an interactive shell with the highest > privileges. The fact that you thanked _jomo for explaining something that effectively quotes almost verbatim what the article tells you indicates you probably didn't bother to read the article. Like with asking help on various forums, it's generally appreciated (or expected, depending on the community) that you do some homework yourself to understand things, state your current understanding, and then ask for confirmation or clarification if your understanding is incorrect. Saying "ELI5 please" comes across as intellectual laziness on your part. If you haven't made any effort to understand an article in plain English (it's no scientific paper we're discussing) then why should others make that effort for you?