3 ms·
they're equal on that part.. but the ssh backdoor was only one part of that announcement. The second part was a backdoor in the VPN (via Dual_EC_DRBG), that per
by rgbrenner 11y ago
they're equal on that part.. but the ssh backdoor was only one part of that announcement. The second part was a backdoor in the VPN (via Dual_EC_DRBG), that permits a passive eavesdropper to decrypt the connection: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7756 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7756
https://www.schneier.com/blog/archives/2015/12/back_door_in_ju.html https://www.schneier.com/blog/archives/2015/12/back_door_in_...
- matt_wulfeck 11y agoMore specifically, the backdoor had been backdoored, as someone replaced the Juniper constants (which itself replaced the NIST constants) in dual_ec with their own, which allowed passive traffic snooping. The backdoor to the backdoor was backdoored.
- dogma1138 11y agoI know but the DualEC one is kinda well meh. Only a single agent can most likely exploit it, it still requires quite a bit of computing power to decrypt even with selected values and you need to be able to capture VPN traffic. The SSH backdoor means that any idiot with basic computer operation skills can log onto a firewall and start playing around with what ever they want.