8 ms·

Developer responds to allegations of FBI backdoor in OpenBSD IPSec

235 points by there 16y ago

3dFlatLander 16y ago
The accusation came at a really strange time. I'm inclined to think more people jumped on the government conspiracy bandwagon because of the recent release of the diplomatic cables via wikileaks. Incidentally, I thought I had seen Mr. Perry someplace on TV, and then I remembered he was on an episode of Penn and Tellers "Bullsh*t" a while back. Link for the interested: http://www.youtube.com/watch?v=DT2YET6sg5I http://www.youtube.com/watch?v=DT2YET6sg5I
- mikedouglas 16y ago
  Many of the commenters in the last thread admitted to this, which made it all the more irrational. There was even a debate about whether, in general, 'conspiracy theories' were more or less common than the public perception. As if that had any bearing on these specific allegations. With the strange claims made in the email (outsourcing, expired NDAs, DARPA knew), I wish Theo would've thought twice before publicizing this guy's name. At least the extra eyes on IPSEC might catch something else.
  - tedunangst 16y ago
    Not publishing the email opens the door to "6 months ago, I emailed Theo about a backdoor, but he's trying to cover it up."
    - mwg66 16y ago
      Only if he kept it to himself and didn't mention it to anybody - I don't think that's what the OP meant.
      - tedunangst 16y ago
        You're only making the conspiracy bigger. :) You'll have a hard time gathering a small circle of people willing to state, for the record, "We reviewed the code and the invisible bug doesn't exist." Personally, I would want no part in an audit like that. For a concrete threat, yeah, you fix it first. But the thing about scandals is that delay only incubates a bigger scandal.
    - deleted 16y ago
      [deleted]
    - tbrownaw 16y ago
      Isn't there a third possibility, "I received an email claiming that there's a backdoor" without publicizing all the additional details?
      - tedunangst 16y ago
        First question: "Who says?" Answer: "I can't say." Second question: "Is it credible?" Option 1: "Yes" => panic ensues. Option 2: "No" => "Liar!" Option 3: There is no option 3, you must pick 1 or 2.
        colanderman 16y ago
        Why is there no option 3? "I am looking into the matter; more details will be forthcoming."
        tedunangst 16y ago
        Third question: "Did you find anything?" Option 1: "Yes" => panic. Option 2: "No" => "Liar!". You have to release all the details sometime, but the longer you wait, the more people suspect they aren't getting all the details (even if they are) and the larger the drama whirlpool becomes. Did "Kaminsky found a DNS bug, details will be forthcoming" accomplish anything? No, it was a giant clusterfuck. As a side note, I think it's weird that in a "post-wikileaks" era people are arguing that an open source project named openbsd be less transparent.
- cmeiklejohn 16y ago
  Totally agree. I guess the point that gets me is that the NDA had an expire time. Makes no sense at all. Show me the commits.
- febeling 16y ago
  I think Theo de Raadt is right to make the accusation open, because it is quite a serious thing. On the other hand, I know that such an accusation can have a devastating effect on the live of the accused developer. So the principle of _in dubio pro reo_ should be applied faithfully. This should be the instinctive reaction of a democratic society. It does seem to be quite hard to have this collective routine work reliably nowadays, which is sad.
kenjackson 16y ago
If Jason didn't put in the backdoors, then who did? :-)
- Zak 16y ago
  As far as I am aware, no actual backdoors have been discovered. This has a high probability of being a hoax.
  - Nrsolis 16y ago
    Of course it does. But I do think it's worthwhile to take measure of how important a particular piece of software is to our collective security and privacy. It's not necessarily a bad thing for interested parties to not completely trust their systems. Risk mitigation is all about quantifying probable events relative to their damage. I think a lot of people will take a look at the IPSEC code and that can't be a bad thing.
  - mwg66 16y ago
    It just seems odd to me that a seemingly well respected engineer would fabricate allegations using his corporate e-mail (VMWare). We should remember it was not he who posted them publicly. I'm not saying it's true but only that I don't see any more evidence that it isn't true than that it is - yet.
    - bmastenbrook 16y ago
      Perry doesn't work for VMware. He has his own business that offers training on VMware products.
      - mwg66 16y ago
        Right, sorry, I missed that. It still seems odd.
  - eps 16y ago
    Backdoors need not be literal. A well-misplaced if will go a long way in leaking a key information. Hardly a "backdoor" in a more common sense of the word, but an exploitable weakness nonetheless.
peterbotond 16y ago
a socially engineered email to exploit the idea of sheeple do not think, just follow with the parrots. at the cost of the innocent.
grandalf 16y ago
It's really funny how there is so much indignation about this. What difference does it make whether it's true or false, there should be an audit of the code. It's this sort of emotional, knee-jerk response that leads to irrational behavior.
- frisco 16y ago
  It's a big allegation. This email didn't strike me as an overly emotional response. It was a very firm refutation from a respected member of the community about a hefty accusation.
  - chubs 16y ago
    I think his refutation was quite calm, solid, and respectable.
    - grandalf 16y ago
      Well, it was focused mostly on his reputation, not on the code. If he had been involved in writing a back door, this is precisely the kind of response he'd write. It makes it personal, etc. Someone who hadn't written a back door would simply say: "That is crazy, I had nothing to do with a back door and none exists to my knowledge. I welcome a thorough audit of the code".
      - SwellJoe 16y ago
        "That is crazy, I had nothing to do with a back door and none exists to my knowledge. I welcome a thorough audit of the code". That's pretty much exactly what he said, in more verbose form.
        grandalf 16y ago
        The idea that it's preposterous that there would have been exploits is part of the knee-jerk reaction. If the FBI will try to infiltrate (and nearly entrap) muslim immigrants, why is it so farfetched that it would hire very bright cryptographers to infiltrate an open source community that is developing its own military grade crypto and giving it away free?
motters 16y ago
Fortunately there's a way to resolve whether this is whistle blowing or mud slinging. Someone with some expertise in that area should audit the code to check whether the allegations have any basis. The original email makes some fairly specific claims, at least some of which are probably verifiable.
- gnaffle 16y ago
  The code has probably already been audited, but of course, more audits might reveal more problems. However, there might be non-obvious ways to make the code vulnerable to side-channel/timing attacks, and if you don't know what you're looking for, the only thing you can really do is to take as many precautions as you can. For how many years did the NSA know about timing attacks before they became public knowledge and fixes were incorporated into code? Impossible to know. Code audits certainly didn't spot timing attack problems before people knew to look for them. It's also impossible to know what other unknown attacks are available to NSA and the likes. Of course, this is completely irrelevant to 99% of us, since anyone with knowledge of these unknown attacks would use them very sparingly in order to keep them secret.
- khafra 16y ago
  It can be tricky to find purposefully subtle bugs: http://underhanded.xcott.com/ http://underhanded.xcott.com/
geekinthecorner 16y ago
In the 9 or 10 years since I first heard about OpenBSD, it has never come up in conversation without the related scene drama also popping up.
davidj 16y ago
The reason OpenBSD was thought of so secured is because they audited the entire code at one time and continuously audit code for new holes. The reason they audited the code in the first place was because way back in the day the main OpenBSD server was compromised and backdoors were placed in the code. They do not like people to know this.
- piotrSikora 16y ago
  Source?
  - davidj 16y ago
    http://www.cert.org/advisories/CA-2002-24.html http://www.cert.org/advisories/CA-2002-24.html I am still looking for the break-in that predates this breakin, my memory is fucking horrible. I apologize. It will take me a while for me to find it.
    - piotrSikora 16y ago
      Thanks for the advisory, but you've got the facts wrong: 1) Main OpenBSD server wasn't compromised, main FTP server ("ftp.openbsd.org") was. 2) Source code (the one in CVS) wasn't compromised, only .tar.gz packages placed on the FTP server were. 3) They did want people to know about this, that's why they released security advisory [1]. On top of that, at the time "ftp.openbsd.org" wasn't even running OpenBSD, the FTP server was part of SunSITE powered by Solaris [2]. [1] http://marc.info/?l=openbsd-misc&m=102821528812161&w=2 http://marc.info/?l=openbsd-misc&m=102821528812161&w... [2] http://www.openbsd.org/cgi-bin/cvsweb/www/faq/faq8.html.diff?r1=1.53;r2=1.54;f=h http://www.openbsd.org/cgi-bin/cvsweb/www/faq/faq8.html.diff...
      - davidj 16y ago
        This wasn't in 2002, this was back in the 90s, I want to say 1996 or 1997. The source code was back-doored. The advisory you found was for completely different break-in in 2002.
dwc 16y ago
Jason L. Wright is known by many as "Wookiee" for reasons that may be obvious to many of you. Now I realize that it's been done before, but would it be too much to ask that we consider the term Wookieeleaks when referring to this matter? ;-)
- sitmack 16y ago
  Chewie was a female and being pregnant most of the time from her incessant whoring resulting in the hairy toe head always putting pressure on her bladder ... did cause a leak or two.
Flemlord 16y ago
Knowing nothing about the issue at hand or how many flavors/components/frameworks of OpenBSD exist, this struck me as some careful parsing: > I will state clearly that I did not add backdoors to the OpenBSD operating system or the OpenBSD crypto framework (OCF).
- tvon 16y ago
  I take it as someone trying to be extremely clear that they did not do what they are being accused of doing.
slim 16y ago
I can't believe Perry don't have proofs of what he's saying in the form of code. I bet we won't wait for audit to see the code. We're talking about code guys. It's not accusation of rape or broken condom.
drawkbox 16y ago
Not sure what to believe here but we do know that the NSA and authorities do need to have access to data for security. If there are systems that aren't apt to putting in backdoors or trapdoors then they treat you like Phil Zimmerman in the 90's by dropping the DOJ on you: http://www.philzimmermann.com/EN/faq/index.html http://www.philzimmermann.com/EN/faq/index.html + http://en.wikipedia.org/wiki/Phil_Zimmermann http://en.wikipedia.org/wiki/Phil_Zimmermann or at least that was the MO at that time. But the DOJ and US Customs dropped the case against Zimmerman in '96. Obviously they would need to go with a new plan of attack after that method failed for intercepting messages in algorithms and software that is closed or running new algorithms like PGP. Backdoors and trapdoors in software that wraps crypto algorithms is one prong in that attack. The NSA neither confirms nor denies trapdoors, backdoors, etc but DOES employ some of the top cryptographers in the world. In 2000, the U.S. government lifted the export controls on strong crypto, so (pure speculation) other methods to intercept communications were/are needed. The alleged event here happened in 2000/2001 which might fit with a new MO.
tedunangst 16y ago
I submitted this a little while ago, but it's scrolled off the new submissions page while this story seems to be hanging on, so reposting here. Sorry for the submission pimping. http://news.ycombinator.com/item?id=2010606 http://news.ycombinator.com/item?id=2010606 http://marc.info/?l=openbsd-cvs&m=129245633605693&w=2 http://marc.info/?l=openbsd-cvs&m=129245633605693&w=...
deleted 16y ago
[deleted]
losethos 16y ago
God always has His way, at least on things He cares about, so I'm pretty relaxed. Did you clear it with God? God says... contagion temples imperfection questioned raven progress signs ashamed Sovereign allaying And profited angel secure stomach unconsciously strings lack tax praying protraction continuance class Up disgraced forgiving shortly partners immortality discovery slaves deceits left stroke dry predicated Athanasius bud EXPRESS Jesus ushered transitory govemed computer diligence thefts significations smells passengers aware vintage entreat Highness touch all wood skirmishes glance augmenting misdeeds provided chastely assiduously urge trials prevails backs rejoiceth forthcoming mysterious briars Windus sinks biting wail bed lastly furnace Unchangeable vouchsafest vehement

235 points by there 16y ago

The accusation came at a really strange time. I'm inclined to think more people jumped on the government conspiracy bandwagon because of the recent release of the diplomatic cables via wikileaks. Incidentally, I thought I had seen Mr. Perry someplace on TV, and then I remembered he was on an episode of Penn and Tellers "Bullsh*t" a while back. Link for the interested: http://www.youtube.com/watch?v=DT2YET6sg5I http://www.youtube.com/watch?v=DT2YET6sg5I

mikedouglas 16y ago
Many of the commenters in the last thread admitted to this, which made it all the more irrational. There was even a debate about whether, in general, 'conspiracy theories' were more or less common than the public perception. As if that had any bearing on these specific allegations. With the strange claims made in the email (outsourcing, expired NDAs, DARPA knew), I wish Theo would've thought twice before publicizing this guy's name. At least the extra eyes on IPSEC might catch something else.
- tedunangst 16y ago
  Not publishing the email opens the door to "6 months ago, I emailed Theo about a backdoor, but he's trying to cover it up."
  - mwg66 16y ago
    Only if he kept it to himself and didn't mention it to anybody - I don't think that's what the OP meant.
    - tedunangst 16y ago
      You're only making the conspiracy bigger. :) You'll have a hard time gathering a small circle of people willing to state, for the record, "We reviewed the code and the invisible bug doesn't exist." Personally, I would want no part in an audit like that. For a concrete threat, yeah, you fix it first. But the thing about scandals is that delay only incubates a bigger scandal.
  - deleted 16y ago
    [deleted]
  - tbrownaw 16y ago
    Isn't there a third possibility, "I received an email claiming that there's a backdoor" without publicizing all the additional details?
    - tedunangst 16y ago
      First question: "Who says?" Answer: "I can't say." Second question: "Is it credible?" Option 1: "Yes" => panic ensues. Option 2: "No" => "Liar!" Option 3: There is no option 3, you must pick 1 or 2.
      - colanderman 16y ago
        Why is there no option 3? "I am looking into the matter; more details will be forthcoming."
        tedunangst 16y ago
        Third question: "Did you find anything?" Option 1: "Yes" => panic. Option 2: "No" => "Liar!". You have to release all the details sometime, but the longer you wait, the more people suspect they aren't getting all the details (even if they are) and the larger the drama whirlpool becomes. Did "Kaminsky found a DNS bug, details will be forthcoming" accomplish anything? No, it was a giant clusterfuck. As a side note, I think it's weird that in a "post-wikileaks" era people are arguing that an open source project named openbsd be less transparent.
cmeiklejohn 16y ago
Totally agree. I guess the point that gets me is that the NDA had an expire time. Makes no sense at all. Show me the commits.
febeling 16y ago
I think Theo de Raadt is right to make the accusation open, because it is quite a serious thing. On the other hand, I know that such an accusation can have a devastating effect on the live of the accused developer. So the principle of _in dubio pro reo_ should be applied faithfully. This should be the instinctive reaction of a democratic society. It does seem to be quite hard to have this collective routine work reliably nowadays, which is sad.

kenjackson 16y ago

If Jason didn't put in the backdoors, then who did? :-)

Zak 16y ago
As far as I am aware, no actual backdoors have been discovered. This has a high probability of being a hoax.
- Nrsolis 16y ago
  Of course it does. But I do think it's worthwhile to take measure of how important a particular piece of software is to our collective security and privacy. It's not necessarily a bad thing for interested parties to not completely trust their systems. Risk mitigation is all about quantifying probable events relative to their damage. I think a lot of people will take a look at the IPSEC code and that can't be a bad thing.
- mwg66 16y ago
  It just seems odd to me that a seemingly well respected engineer would fabricate allegations using his corporate e-mail (VMWare). We should remember it was not he who posted them publicly. I'm not saying it's true but only that I don't see any more evidence that it isn't true than that it is - yet.
  - bmastenbrook 16y ago
    Perry doesn't work for VMware. He has his own business that offers training on VMware products.
    - mwg66 16y ago
      Right, sorry, I missed that. It still seems odd.
- eps 16y ago
  Backdoors need not be literal. A well-misplaced if will go a long way in leaking a key information. Hardly a "backdoor" in a more common sense of the word, but an exploitable weakness nonetheless.

peterbotond 16y ago

a socially engineered email to exploit the idea of sheeple do not think, just follow with the parrots. at the cost of the innocent.

grandalf 16y ago

It's really funny how there is so much indignation about this. What difference does it make whether it's true or false, there should be an audit of the code. It's this sort of emotional, knee-jerk response that leads to irrational behavior.

frisco 16y ago
It's a big allegation. This email didn't strike me as an overly emotional response. It was a very firm refutation from a respected member of the community about a hefty accusation.
- chubs 16y ago
  I think his refutation was quite calm, solid, and respectable.
  - grandalf 16y ago
    Well, it was focused mostly on his reputation, not on the code. If he had been involved in writing a back door, this is precisely the kind of response he'd write. It makes it personal, etc. Someone who hadn't written a back door would simply say: "That is crazy, I had nothing to do with a back door and none exists to my knowledge. I welcome a thorough audit of the code".
    - SwellJoe 16y ago
      "That is crazy, I had nothing to do with a back door and none exists to my knowledge. I welcome a thorough audit of the code". That's pretty much exactly what he said, in more verbose form.
      - grandalf 16y ago
        The idea that it's preposterous that there would have been exploits is part of the knee-jerk reaction. If the FBI will try to infiltrate (and nearly entrap) muslim immigrants, why is it so farfetched that it would hire very bright cryptographers to infiltrate an open source community that is developing its own military grade crypto and giving it away free?

motters 16y ago

Fortunately there's a way to resolve whether this is whistle blowing or mud slinging. Someone with some expertise in that area should audit the code to check whether the allegations have any basis. The original email makes some fairly specific claims, at least some of which are probably verifiable.

gnaffle 16y ago
The code has probably already been audited, but of course, more audits might reveal more problems. However, there might be non-obvious ways to make the code vulnerable to side-channel/timing attacks, and if you don't know what you're looking for, the only thing you can really do is to take as many precautions as you can. For how many years did the NSA know about timing attacks before they became public knowledge and fixes were incorporated into code? Impossible to know. Code audits certainly didn't spot timing attack problems before people knew to look for them. It's also impossible to know what other unknown attacks are available to NSA and the likes. Of course, this is completely irrelevant to 99% of us, since anyone with knowledge of these unknown attacks would use them very sparingly in order to keep them secret.
khafra 16y ago
It can be tricky to find purposefully subtle bugs: http://underhanded.xcott.com/ http://underhanded.xcott.com/

geekinthecorner 16y ago

In the 9 or 10 years since I first heard about OpenBSD, it has never come up in conversation without the related scene drama also popping up.

davidj 16y ago

The reason OpenBSD was thought of so secured is because they audited the entire code at one time and continuously audit code for new holes. The reason they audited the code in the first place was because way back in the day the main OpenBSD server was compromised and backdoors were placed in the code. They do not like people to know this.

piotrSikora 16y ago
Source?
- davidj 16y ago
  http://www.cert.org/advisories/CA-2002-24.html http://www.cert.org/advisories/CA-2002-24.html I am still looking for the break-in that predates this breakin, my memory is fucking horrible. I apologize. It will take me a while for me to find it.
  - piotrSikora 16y ago
    Thanks for the advisory, but you've got the facts wrong: 1) Main OpenBSD server wasn't compromised, main FTP server ("ftp.openbsd.org") was. 2) Source code (the one in CVS) wasn't compromised, only .tar.gz packages placed on the FTP server were. 3) They did want people to know about this, that's why they released security advisory [1]. On top of that, at the time "ftp.openbsd.org" wasn't even running OpenBSD, the FTP server was part of SunSITE powered by Solaris [2]. [1] http://marc.info/?l=openbsd-misc&m=102821528812161&w=2 http://marc.info/?l=openbsd-misc&m=102821528812161&w... [2] http://www.openbsd.org/cgi-bin/cvsweb/www/faq/faq8.html.diff?r1=1.53;r2=1.54;f=h http://www.openbsd.org/cgi-bin/cvsweb/www/faq/faq8.html.diff...
    - davidj 16y ago
      This wasn't in 2002, this was back in the 90s, I want to say 1996 or 1997. The source code was back-doored. The advisory you found was for completely different break-in in 2002.

dwc 16y ago

Jason L. Wright is known by many as "Wookiee" for reasons that may be obvious to many of you. Now I realize that it's been done before, but would it be too much to ask that we consider the term Wookieeleaks when referring to this matter? ;-)

sitmack 16y ago
Chewie was a female and being pregnant most of the time from her incessant whoring resulting in the hairy toe head always putting pressure on her bladder ... did cause a leak or two.

Flemlord 16y ago

Knowing nothing about the issue at hand or how many flavors/components/frameworks of OpenBSD exist, this struck me as some careful parsing: > I will state clearly that I did not add backdoors to the OpenBSD operating system or the OpenBSD crypto framework (OCF).

tvon 16y ago
I take it as someone trying to be extremely clear that they did not do what they are being accused of doing.

slim 16y ago

I can't believe Perry don't have proofs of what he's saying in the form of code. I bet we won't wait for audit to see the code. We're talking about code guys. It's not accusation of rape or broken condom.

drawkbox 16y ago

Not sure what to believe here but we do know that the NSA and authorities do need to have access to data for security. If there are systems that aren't apt to putting in backdoors or trapdoors then they treat you like Phil Zimmerman in the 90's by dropping the DOJ on you: http://www.philzimmermann.com/EN/faq/index.html http://www.philzimmermann.com/EN/faq/index.html + http://en.wikipedia.org/wiki/Phil_Zimmermann http://en.wikipedia.org/wiki/Phil_Zimmermann or at least that was the MO at that time. But the DOJ and US Customs dropped the case against Zimmerman in '96. Obviously they would need to go with a new plan of attack after that method failed for intercepting messages in algorithms and software that is closed or running new algorithms like PGP. Backdoors and trapdoors in software that wraps crypto algorithms is one prong in that attack. The NSA neither confirms nor denies trapdoors, backdoors, etc but DOES employ some of the top cryptographers in the world. In 2000, the U.S. government lifted the export controls on strong crypto, so (pure speculation) other methods to intercept communications were/are needed. The alleged event here happened in 2000/2001 which might fit with a new MO.

tedunangst 16y ago

I submitted this a little while ago, but it's scrolled off the new submissions page while this story seems to be hanging on, so reposting here. Sorry for the submission pimping. http://news.ycombinator.com/item?id=2010606 http://news.ycombinator.com/item?id=2010606 http://marc.info/?l=openbsd-cvs&m=129245633605693&w=2 http://marc.info/?l=openbsd-cvs&m=129245633605693&w=...

deleted 16y ago

[deleted]

losethos 16y ago

God always has His way, at least on things He cares about, so I'm pretty relaxed. Did you clear it with God? God says... contagion temples imperfection questioned raven progress signs ashamed Sovereign allaying And profited angel secure stomach unconsciously strings lack tax praying protraction continuance class Up disgraced forgiving shortly partners immortality discovery slaves deceits left stroke dry predicated Athanasius bud EXPRESS Jesus ushered transitory govemed computer diligence thefts significations smells passengers aware vintage entreat Highness touch all wood skirmishes glance augmenting misdeeds provided chastely assiduously urge trials prevails backs rejoiceth forthcoming mysterious briars Windus sinks biting wail bed lastly furnace Unchangeable vouchsafest vehement