6 ms·

How can we know that it is the only backdoor? Wouldn't be safer to just stop using Juniper's products altogether?

by zouhair 11y ago

ghshephard 11y ago
On the flip side - now that this product, and it's code base, is presumably under such close inspection by Juniper, perhaps Juniper's product is more secure than others that aren't going through such close review.
- dogma1138 11y ago
  If othe back doors are as well hidden as this one it will take a while to find them out and even then you might not find all of them. ScreenOS has probably 2 decades worth of code in it, some of it is sure to no be well documented.
  - ghshephard 11y ago
    Once you know that your code has been corrupted, it would take a team of consultants put together by someone like ptacek a relatively short period of time to find the holes (and, at the same time, discover 10x or more code weaknesses that weren't deliberately put there.) If the toolchain wasn't corrupted, and this was in the original source code (C?) - it's not going to be too difficult to find in code review, if you are looking for it - but how many companies are willing to spend the time (and $$$) to review their presumed secure code for holes added by third-parties? Now that Juniper knows that their source-code/tool chain has been breached, they will be prepared to spend the money to clean it up - which, for any reasonable amount of code, will cost millions of $$$ if not tens of millions. I'm wondering if patio11/ptacek didn't show some pretty amazing foresight in tracking down the resumes of the top security intrusion people in the industry - I have to believe that the Ciscos, Junipers, and other security hardware/software companies in the world are going to be in desperate need of Top People, and are going to be ready to pay large sums of $$$ for fast service in this space.
    - lazaroclapp 11y ago
      > If the toolchain wasn't corrupted, and this was in the original source code (C?) - it's not going to be too difficult to find in code review, if you are looking for it I was part of a research project, in which, as part of the evaluation, we were given small Android applications (1-10k lines of code, not obfuscated). We were told that each of the apps contained a single piece of embedded malicious functionality hidden in its otherwise known/innocuous behavior. We were given a few weeks to find the malicious functionality. The main goal was to use our prototype software analysis tools. But in those cases in which we had to perform manual source analysis, the implanted functionality often eluded us for 10-25% of the cases. Now, you might be able to find people who are more experienced at software auditing than us (a bunch of Ph.D. students in security and compiler-related areas). But you might also find more experienced implant writers as well. Also, in a case like this, you don't know how many implants there are, how much of the internal company network is also compromised, how many (if any) of your remaining employees is an attacker, etc.
      - ghshephard 11y ago
        Fair point - but I'm thinking that a company like Juniper, which has critical branding and revenue on the lines, can afford to hire the 100 top-of-the-line pen testers for 90 days to scrub through their code (with various members have different areas of speciality - which would be important in a situation like ScreenOS which has so much breadth). Figure a top-end pen tester goes for around $300-$400K/year + 50% consulting Markup - $600K/year works out to $150K/90 days * 100 pen testers = $15mm. The level of performance out of a $400k/year pen tester is pretty good. 100 of them can really scrub a code base pretty well. $15mm might sounds like a lot of money to you and I - but you would be amazed to see how quickly the money flows when there is a security issue at stake. Also - since the Target CEO (http://www.cbc.ca/news/business/tony-fisher-fired-as-target-canada-president-1.2647934 http://www.cbc.ca/news/business/tony-fisher-fired-as-target-...) got axed as a result of a security event, budgeting for security responses has strong CxO level support. In addition to the consulting workforce you can pull in for this type of project, you also presumably have a highly motivated internal workforce that will be pulling long hours, and working hard to support the pen testers as well.
- rdtsc 11y ago
  It goes both ways. One can say "oh well, they are looking at code and weeding this out, these guys know what they are doing" or you can say "these are a bunch of either amateurs or they are malicious and in bed with some high stakes player who is not our friend, stay away!". So it kind of depends. Who do you turn for your high throughput switches. I am not familiar with that market at all, but wondering if just buying asics, fpgas and some hardware then loading an open source OS on it is viable....
xxpor 11y ago
How can you be sure Cisco (or whomever) is any safer?
- coleca 11y ago
  Looks like it will be a good week to be a Cisco salesman. Hopefully Juniper can get past this as the competition between them is a healthy thing for the marketplace.
nl 11y ago
What do you propose to use instead? Cisco[1]? Huawei[2]? Open Source[3]? [1] http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-... [2] http://www.bmi-t.co.za/content/which-way-huawei-ban-or-not-ban http://www.bmi-t.co.za/content/which-way-huawei-ban-or-not-b... [3] http://arstechnica.com/security/2014/01/how-the-nsa-may-have-put-a-backdoor-in-rsas-cryptography-a-technical-primer/ http://arstechnica.com/security/2014/01/how-the-nsa-may-have...
- rdtsc 11y ago
  So based on that [3], open source then. What are the high speed and feature-wise comparable open source solutions to a the compromised Juniper switches?
  - SteveNuts 11y ago
    There isn't one.
  - f2f 11y ago
    > So based on that [3], open source then. nortel networks. no bugs in the last few years.
    - jhall1468 11y ago
      > nortel networks. no bugs in the last few years. No known bugs.
    - alex_anglin 11y ago
      Good luck buying from a company that's gone out of business.
    - rogeryu 11y ago
      > nortel networks. no bugs in the last few years. One week ago we could say this of Juniper as well.
  - 11y ago
thrownaway2424 11y ago
Yes it absolutely would be safer. There is no legitimate reason to use a black box VPN. Crypto should done at the application level, client-to-server.

How can we know that it is the only backdoor? Wouldn't be safer to just stop using Juniper's products altogether?

by zouhair 11y ago

How can we know that it is the only backdoor? Wouldn't be safer to just stop using Juniper's products altogether?

On the flip side - now that this product, and it's code base, is presumably under such close inspection by Juniper, perhaps Juniper's product is more secure than others that aren't going through such close review.

dogma1138 11y ago
If othe back doors are as well hidden as this one it will take a while to find them out and even then you might not find all of them. ScreenOS has probably 2 decades worth of code in it, some of it is sure to no be well documented.
- ghshephard 11y ago
  Once you know that your code has been corrupted, it would take a team of consultants put together by someone like ptacek a relatively short period of time to find the holes (and, at the same time, discover 10x or more code weaknesses that weren't deliberately put there.) If the toolchain wasn't corrupted, and this was in the original source code (C?) - it's not going to be too difficult to find in code review, if you are looking for it - but how many companies are willing to spend the time (and $$$) to review their presumed secure code for holes added by third-parties? Now that Juniper knows that their source-code/tool chain has been breached, they will be prepared to spend the money to clean it up - which, for any reasonable amount of code, will cost millions of $$$ if not tens of millions. I'm wondering if patio11/ptacek didn't show some pretty amazing foresight in tracking down the resumes of the top security intrusion people in the industry - I have to believe that the Ciscos, Junipers, and other security hardware/software companies in the world are going to be in desperate need of Top People, and are going to be ready to pay large sums of $$$ for fast service in this space.
  - lazaroclapp 11y ago
    > If the toolchain wasn't corrupted, and this was in the original source code (C?) - it's not going to be too difficult to find in code review, if you are looking for it I was part of a research project, in which, as part of the evaluation, we were given small Android applications (1-10k lines of code, not obfuscated). We were told that each of the apps contained a single piece of embedded malicious functionality hidden in its otherwise known/innocuous behavior. We were given a few weeks to find the malicious functionality. The main goal was to use our prototype software analysis tools. But in those cases in which we had to perform manual source analysis, the implanted functionality often eluded us for 10-25% of the cases. Now, you might be able to find people who are more experienced at software auditing than us (a bunch of Ph.D. students in security and compiler-related areas). But you might also find more experienced implant writers as well. Also, in a case like this, you don't know how many implants there are, how much of the internal company network is also compromised, how many (if any) of your remaining employees is an attacker, etc.
    - ghshephard 11y ago
      Fair point - but I'm thinking that a company like Juniper, which has critical branding and revenue on the lines, can afford to hire the 100 top-of-the-line pen testers for 90 days to scrub through their code (with various members have different areas of speciality - which would be important in a situation like ScreenOS which has so much breadth). Figure a top-end pen tester goes for around $300-$400K/year + 50% consulting Markup - $600K/year works out to $150K/90 days * 100 pen testers = $15mm. The level of performance out of a $400k/year pen tester is pretty good. 100 of them can really scrub a code base pretty well. $15mm might sounds like a lot of money to you and I - but you would be amazed to see how quickly the money flows when there is a security issue at stake. Also - since the Target CEO (http://www.cbc.ca/news/business/tony-fisher-fired-as-target-canada-president-1.2647934 http://www.cbc.ca/news/business/tony-fisher-fired-as-target-...) got axed as a result of a security event, budgeting for security responses has strong CxO level support. In addition to the consulting workforce you can pull in for this type of project, you also presumably have a highly motivated internal workforce that will be pulling long hours, and working hard to support the pen testers as well.
rdtsc 11y ago
It goes both ways. One can say "oh well, they are looking at code and weeding this out, these guys know what they are doing" or you can say "these are a bunch of either amateurs or they are malicious and in bed with some high stakes player who is not our friend, stay away!". So it kind of depends. Who do you turn for your high throughput switches. I am not familiar with that market at all, but wondering if just buying asics, fpgas and some hardware then loading an open source OS on it is viable....

xxpor 11y ago

How can you be sure Cisco (or whomever) is any safer?

coleca 11y ago
Looks like it will be a good week to be a Cisco salesman. Hopefully Juniper can get past this as the competition between them is a healthy thing for the marketplace.

nl 11y ago

What do you propose to use instead? Cisco[1]? Huawei[2]? Open Source[3]? [1] http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-... [2] http://www.bmi-t.co.za/content/which-way-huawei-ban-or-not-ban http://www.bmi-t.co.za/content/which-way-huawei-ban-or-not-b... [3] http://arstechnica.com/security/2014/01/how-the-nsa-may-have-put-a-backdoor-in-rsas-cryptography-a-technical-primer/ http://arstechnica.com/security/2014/01/how-the-nsa-may-have...

rdtsc 11y ago
So based on that [3], open source then. What are the high speed and feature-wise comparable open source solutions to a the compromised Juniper switches?
- SteveNuts 11y ago
  There isn't one.
- f2f 11y ago
  > So based on that [3], open source then. nortel networks. no bugs in the last few years.
  - jhall1468 11y ago
    > nortel networks. no bugs in the last few years. No known bugs.
  - alex_anglin 11y ago
    Good luck buying from a company that's gone out of business.
  - rogeryu 11y ago
    > nortel networks. no bugs in the last few years. One week ago we could say this of Juniper as well.
- 11y ago

thrownaway2424 11y ago

Yes it absolutely would be safer. There is no legitimate reason to use a black box VPN. Crypto should done at the application level, client-to-server.