Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#1

Post by r721 » Sat, Dec 19, 2015, 7:17 AM UTC

Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors
wired.com

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#2

Post by danso » Sat, Dec 19, 2015, 7:54 AM UTC

I'm looking at Juniper's news page [1] and its Twitter feed [2]...it doesn't give me a lot of confidence that this security breach or even its (apparently inadequate) patch doesn't even a news item or a Tweet.

[1] http://newsroom.juniper.net/

[2] https://twitter.com/JuniperNetworks/with_replies

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#3

Post by blazespin » Sat, Dec 19, 2015, 7:57 AM UTC

The big story here is not that Juniper is weak but rather that these types of attacks are succeeding. If Juniper has fallen, god knows what else is vulnerable.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#4

Post by jjp » Sat, Dec 19, 2015, 8:06 AM UTC

danso wrote: post #2

I'm looking at Juniper's news page [1] and its Twitter feed [2]...it doesn't give me a lot of confidence that this security breach or even its (apparently inadequate) patch doesn't even a news item or a Tweet. [1] http://newsroom.juniper.net/ [2] https://twitter.com/JuniperNetworks/with_replies

Was discussed yesterday on this thread https://news.ycombinator.com/item?id=10754917 which points to the proactive announcement Juniper made

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#5

Post by SyneRyder » Sat, Dec 19, 2015, 8:17 AM UTC

jjp wrote: post #4

danso wrote: post #2

I'm looking at Juniper's news page [1] and its Twitter feed [2]...it doesn't give me a lot of confidence that this security breach or even its (apparently inadequate) patch doesn't even a news item or a Tweet. [1] http://newsroom.juniper.net/ [2] https://twitter.com/JuniperNetworks/with_replies

Was discussed yesterday on this thread https://news.ycombinator.com/item?id=10754917 which points to the proactive announcement Juniper made

There's also http://advisory.juniper.net/ with further details on each security notice.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#6

Post by huuu » Sat, Dec 19, 2015, 8:20 AM UTC

It's sad but events like this one make me turn away from Internet.

I started using Signal because I don't want people seeing the messages I post. But in the end it's only trust that makes me think Signal is safe to use.

A lot of people also trusted Juniper. But that trust is gone. And not only for Juniper. What about other brands? We don't know.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#7

Post by mjs » Sat, Dec 19, 2015, 8:25 AM UTC

huuu wrote: post #6

It's sad but events like this one make me turn away from Internet. I started using Signal because I don't want people seeing the messages I post. But in the end it's only trust that makes me think Signal is safe to use. A lot of people also trusted Juniper. But that trust is gone. And not only for Juniper. What about other brands? We don't know.

You're still secure if you use https. If neither your computer nor the host you're connecting to has been tampered with, then you're safe irrespective of what's happening between.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#8

Post by nickodell » Sat, Dec 19, 2015, 8:32 AM UTC

mjs wrote: post #7

huuu wrote: post #6

It's sad but events like this one make me turn away from Internet. I started using Signal because I don't want people seeing the messages I post. But in the end it's only trust that makes me think Signal is safe to use. A lot of people also trusted Juniper. But that trust is gone. And not only for Juniper. What about other brands? We don't know.

You're still secure if you use https. If neither your computer nor the host you're connecting to has been tampered with, then you're safe irrespective of what's happening between.

Well, what if the host you're connecting to is a Juniper firewall?

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#9

Post by Buge » Sat, Dec 19, 2015, 8:48 AM UTC

Wow that nation state is stupid.

They embedded the backdoor password right into it. Clearly they should have embedded the hash of the password instead. Then it would be unbreakable and no other party would be able to use the backdoor.

Hashing passwords is extremely basic security practice.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#10

Post by acd » Sat, Dec 19, 2015, 8:57 AM UTC

Some corporations will not know about the issue or ignore it and thus will get hacked by the backdoor. Now this backdoor does not only benefit those who implanted it, it will benefit the opposing side who can hack using it.