3 ms·
No, the attackers just re-pinned the backdoor lock cylinder that the NSA put on their "secure" door. That's why nobody noticed. The NSA conveniently left them a
by marcan_42 5y ago
No, the attackers just re-pinned the backdoor lock cylinder that the NSA put on their "secure" door. That's why nobody noticed. The NSA conveniently left them a door with a backdoor they could hijack in a way that is effectively invisible.
Replacing the whole door would've been like replacing the entire DRBG, which would've much more likely raised alarms.
- eli 5y agoHaving a convenient backdoor already integrated definitely aided the attack, but a sophisticated attacker with the ability to silently modify your codebase is a pretty bad place to start from regardless.
- convolvatron 5y agohow would you possibly prevent such a thing? even if Juniper subjected all potential employees to clearance-like screening - that's not foolproof either.
- lostmsu 5y agoAbsolute prevention is probably impossible, but you can severely reduce the chances of successful attack by a) limiting access to security critical parts of code b) having shadow reviews of the same code (e.g. a separate team, that gets a notification every time these pieces of code are modified, and re-reviews them without notifying the original patch submitter)