6 ms·

The link in the tweet is worth a read[1]. >My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a numb

by wil421 7y ago

The link in the tweet is worth a read[1]. >My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI. Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC. [1]https://marc.info/?l=openbsd-tech&m=129236621626462 https://marc.info/?l=openbsd-tech&m=129236621626462

ProCicero 7y ago
Nitpicking here, but the parent agency of the FBI is the Department of Justice. The EOUSA is the Executive Office of United States Attorneys, and is basically the back office support for the 93 US Attorney offices. It's parent organization is also the Department of Justice. Basically, he is saying the DOJ planted a back door so that it could spy on its own internal network.
- wil421 7y ago
  I was confused by this and it’s the first time I’ve heard of EOUSA. What’s the real story here?
  - equalunique 7y ago
    Factions in government are sometimes caught spying on gov organizations that have oversight/control athority over them. That was the real scandal of Edward Snowden's bombshell (that was quickly covered up).
tinus_hn 7y ago
That’s almost 10 years ago. Was the backdoor ever found?
- tptacek 7y ago
  No.
  - StreamBright 7y ago
    I am not sure id the implications. a, there is nothing there to be found b, being opensource is not enough to find security related bugs and backdoors c, ?
    - sslalready 7y ago
      Several people have looked into the issue over the years but so far no traces of malicious intent have been found.
Tharkun 7y ago
> This is also probably the reason why you lost your DARPA funding I remember this causing a huge stink at the time, with various petty reasons as the alleged cause (like Theo's less-than-friendly communication style).
- Fnoord 7y ago
  The quote from Theo being > I actually am fairly uncomfortable about it, even if our firm stipulation was that they cannot tell us what to do. We are simply doing what we do anyways — securing software — and they have no say in the matter. I try to convince myself that our grant means a half of a cruise missile doesn't get built. I don't have a date at hand but it was around the time of the war in Iraq. A while after the quote was made (IIRC in a newspaper) the DARPA funding was cut.
matthewbauer 7y ago
Reply by Jason Wright: https://marc.info/?l=openbsd-tech&m=129244045916861&w=2 https://marc.info/?l=openbsd-tech&m=129244045916861&w=2
- ProCicero 7y ago
  That makes sense. There really is no reason the FBI would ever need backdoor access to EOUSA, let alone compromise open source VPN software in order to get it. There are much easier ways for them to get what they want.
  - o-__-o 7y ago
    Also, it’s Theo DeRaadt. He’s worse than Linus with his outbursts
kilo_bravo_3 7y ago
FBI NDAs never expire...

by wil421 7y ago

ProCicero 7y ago

Nitpicking here, but the parent agency of the FBI is the Department of Justice. The EOUSA is the Executive Office of United States Attorneys, and is basically the back office support for the 93 US Attorney offices. It's parent organization is also the Department of Justice. Basically, he is saying the DOJ planted a back door so that it could spy on its own internal network.

wil421 7y ago
I was confused by this and it’s the first time I’ve heard of EOUSA. What’s the real story here?
- equalunique 7y ago
  Factions in government are sometimes caught spying on gov organizations that have oversight/control athority over them. That was the real scandal of Edward Snowden's bombshell (that was quickly covered up).

tinus_hn 7y ago

That’s almost 10 years ago. Was the backdoor ever found?

tptacek 7y ago
No.
- StreamBright 7y ago
  I am not sure id the implications. a, there is nothing there to be found b, being opensource is not enough to find security related bugs and backdoors c, ?
  - sslalready 7y ago
    Several people have looked into the issue over the years but so far no traces of malicious intent have been found.

Tharkun 7y ago

> This is also probably the reason why you lost your DARPA funding I remember this causing a huge stink at the time, with various petty reasons as the alleged cause (like Theo's less-than-friendly communication style).

Fnoord 7y ago
The quote from Theo being > I actually am fairly uncomfortable about it, even if our firm stipulation was that they cannot tell us what to do. We are simply doing what we do anyways — securing software — and they have no say in the matter. I try to convince myself that our grant means a half of a cruise missile doesn't get built. I don't have a date at hand but it was around the time of the war in Iraq. A while after the quote was made (IIRC in a newspaper) the DARPA funding was cut.

matthewbauer 7y ago

Reply by Jason Wright: https://marc.info/?l=openbsd-tech&m=129244045916861&w=2 https://marc.info/?l=openbsd-tech&m=129244045916861&w=2

ProCicero 7y ago
That makes sense. There really is no reason the FBI would ever need backdoor access to EOUSA, let alone compromise open source VPN software in order to get it. There are much easier ways for them to get what they want.
- o-__-o 7y ago
  Also, it’s Theo DeRaadt. He’s worse than Linus with his outbursts

kilo_bravo_3 7y ago

FBI NDAs never expire...