6 ms·
This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially)
by dannyw 5y ago
This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
- Ansil849 5y agoThis smacks way more of "well, what did you expect would happen?" than surrealism. If you introduce a vulnerability, it is nothing but hubris to think that you'll be the only one to leverage the vulnerability.
- vlovich123 5y agoKind of, but my reading of it is that it was also a supply-side chain attack where they modified the constant that was used in the code before the binary was built. So at that level of access, I'm not sure any algorithms would hold up. I don't think Dual ECDRGB was used to attack the source control system.
- timmytokyo 5y agoThe brilliant part is that they did it in a way that remained undetected for so long. And the reason they could do that is because the backdoor already existed.
- Tylast 5y agoI wonder how much Intellectual Property was exfiltrated because of this?
- throwaway210222 5y agoIts hubris to think that a national state that can design and execute this kind of attack really needs your IP.
- kafkaIncarnate 5y agoIt's decades of antivirus style mindsets (we'll just clean up after), mixed with formerly being in law "enforcement" (we can't do anything until AFTER the law is broken), mixed with decades of "security by obscurity" and paranoid "hide and seek" culture, mixed with 9/11 vengeance, plus American exceptionalism. With a smack of ham to it. I call it hot ham water.
- petre 5y agoThat's what security researchers and cryptographers had been warning about all along. Security for thee but not for me doesn't work.
- deadalus 5y agoWhat if an insider helped the foreign adversary gain access?
- SV_BubbleTime 5y agoDoes that change anything with the NSA getting NIST, DoD, and later mfgs to go along with an algorithm that had two backdoors?
- adventured 5y ago> The NSA made Juniper use a backdoored algorithm It's very important to clarify that the NSA didn't make them use it. The DoD required it as terms for future contracts. Juniper grabbed the money in knowing exchange for putting their customers at risk. Why does that distinction matter? It dramatically increases Juniper's culpability in the scheme. If the DoD had actually forced them to use it, that dramatically reduces Juniper's culpability.
- nitrogen 5y agoThis is exactly how they "make" a company do something. Look at what happened to the Qwest (IIRC?) CEO to see what happens if you refuse these contracts.
- Supermancho 5y agohttps://www.eff.org/deeplinks/2007/10/qwest-ceo-nsa-punished-qwest-refusing-participate-illegal-surveillance-pre-9-11 https://www.eff.org/deeplinks/2007/10/qwest-ceo-nsa-punished... If a company refuses, they are making a decision (more of a gamble). Corporations will almost universally sacrifice customer safety for profit. Especially when they are making a decision between "for sure losing opportunity money" and "maybe losing money after a court case". That does not mean they aren't liable when things go bad.
- PhantomGremlin 5y agoI hate this meme. It's false. Nacchio simply tried to use it as an excuse. He was just throwing shit against the wall and hoping that some of it stuck. Here's his claim: he was not in a rightful state of mind when he sold his shares because of problems with his son, and the imminent announcement of a number of government contracts. Yeah sure, I know exactly what he means. Whenever I'm not in a "rightful state of mind" the way I cope with it is to dump company stock that I'm restricted from selling. /s Nacchio was nothing but a greedy scumbag, and he went to Federal prison because of it. https://en.wikipedia.org/wiki/Joseph_Nacchio https://en.wikipedia.org/wiki/Joseph_Nacchio
- 5y ago
- dheera 5y agoIs there a list of exactly what equipment (model numbers) was breached?
- celticninja 5y agoIt is software not hardware, so whatever model used the software.
- capableweb 5y agoTheoretically you can run any software on any hardware so all hardware in the world is infected. No, I'm not being serious. Obviously what dheera is referring to is not software vs hardware but rather what hardware is affected. To comment that it's the hardware that is running the software that is infected is hardly useful.
- dheera 5y agoRight, I'm wondering what models were designed to officially run the software that was infected, and if there are models that are known (by source code, reverse engineering or otherwise) to run uninfected firmware.
- nowugetme 5y agohttps://setkorp.com https://setkorp.com
- 5y ago
- indymike 5y ago> That's surreal. No, that's expected behavior and will eventually happen approaching the limit of 100% of the time. Even worse, a backdoor is often a greater security risk than normal authorization because the backdoor can often access all the data, not just a single user's data. In short, if you are in government, do not ask for backdoors, if you are in the private sector do not make backdoors. Backdoors are a flawed idea that leads to very bad things for everyone (private sector losses hit government in the pocketbook, too).
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- cryptonector 5y agoKeep in mind that an attacker that can change source code can add a backdoor where there is none. Backdoors are dangerous because their keys can leak. In the case of Dual_EC a leak would have been particularly dangerous because the attack enabled by having the backdoor's key is passive, so not easily detected. A backdoor rekey attack, if it lets the attacker gain a foothold that allows them continued access after the attack is detected. That is really bad!
- mdoms 5y agoIt's Bloomberg. Be skeptical.
- dylan604 5y agoI'm surprised we haven't seen an article explaining that the chip shortage is due to so many hidden chips being secretly placed on mobos used by the largest vendors.
- sockpuppet_12 5y agoWhy is that story so far fetched exactly?
- dylan604 5y agoThat so many hidden/secret chips are being placed on mobos that we are suffering a global chip shortage because of it? Do you really need it explained why that's far fetched? I'm going to let you think on that a bit longer. It should have kicked in by now.
- sockpuppet_12 5y agoI was referring to the Bloomberg article, you can turn off that incredulity-drive now.
- dylan604 5y agoThe Heart of Gold has the improbability drive, while its sister ship the Heart of Silver has the incredulity drive. I like it. I hadn't heard that one before.
- philistine 5y agoIf you are referring to Bloomberg's bombshell story about rogue chips installed on motherboards in China during assembly at the factory that then have compromised Apple and Amazon (referenced here: https://www.aei.org/technology-and-innovation/bloombergs-bombshell-or-dud-on-chinese-espionage-even-if-true-whats-new/ https://www.aei.org/technology-and-innovation/bloombergs-bom...) than the far-fetched element is that it has been three years since the story came out and not a single element of physical evidence have been presented, when one would simply need a microscope to find them in devices. This after multiple major news organizations spent years trying to follow-up on the story and found no evidence whatsoever to back it up. It was a game of telephone gone horribly wrong, and Bloomberg's reputation is shot since they have refused to retract it.
- matheusmoreira 5y agoNot surreal at all. It's exactly what everyone in the cryptography communuty said would happen if people listened to the government and added backdoors for the "good guys". Hope this sort of thing keeps happening. I want more concrete examples to cite when people defend this stupidity. I want the governments of the world to be too embarrassed to talk about cryptography ever again, least of all demand backdoors into private infrastructure.
- kafkaIncarnate 5y agoThey won't. You'll have lists and lists and lists, and they'll just say "you live in a society, you have no reasonable expectation of privacy", and then expect you replace your walls with glass on your house. They're too far gone if they still believe "if you have nothing to hide, you have nothing to fear" so openly.
- j16sdiz 5y agoEveryone think the key will be leaked / mis-used. Nobody think it would be changed by other group without noticing.
- darksaints 5y agoThis needs to be brought up every single time congress proposes encryption backdoors.
- cryptonector 5y agoIt's been done before. Back in the oughts when Congress was proposing CALEA, many told them it was a bad idea.
- TheRealDunkirk 5y agoAnd if you think they only strong-armed Juniper into doing this, I've got seaside real estate in Nevada to show you. AT LEAST Cisco should be considered compromised as well.
- freeopinion 5y agoLakeside property in Nevada is current news.
- the_rectifier 5y agoIt's not groundbreaking: it happened again and again.
- FridayoLeary 5y agoHow do you know it isn't still happening?
- stjohnswarts 5y agolol no! it was totally expected and security people and encryption advocates have been literally saying this kind of thing was bound to happen for Decades. You can only imagine how much of this remains out there. Also, see the recent Apple debacle. Letting government interfere with private business without a warrant is always, always bad. Even with a warrant it is troubling, but at least there are some checks and balances from the courts (supposedly neutral party)
- deleted 5y ago[deleted]