Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

wired.com

Post reply on HN
Print view View original

51–60 of 121 posts

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#51

Post by rtpg »

level09 wrote: post #39
peterkelly wrote: post #21

I like CNN's take on the story: http://edition.cnn.com/2015/12/18/politics/juniper-networks-... Obviously it must be either Russia or China - NSA couldn't possibly be responsible ;)

It can't be NSA agents who caught intercepting network gear from Cisco Systems as it was being shipped to a customer (as revealed by snowden) it is highly unlikely they infected juniper networks as well.

I don't disagree that they might have the intent to, but it's possible they didn't have the capability to.

Much like the difference between forcing sites to hand over SSL certs and breaking SSL, there's a gulf between compromising hardware that you have physical access to and compromising the software stack at the source.

In this case I wouldn't be surprised if that turned out to be the narrative, but the "NSA can accomplish anything" position is a narrative that plays into their favor.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#52

Post by jordigh »

raesene9 wrote: post #47
acd wrote: post #44

This also highlights why it would be better to use opensource firewalls such as Openbsd instead of proprietary ones! If you care about your security then you need to be able to inspect the code that protects your assets. Distributed open source firewall vs propritary firewall with backdoors.

Of course the idea that open source software in general, and firewalls in specific are better than closed source ones relies on people actually having the skills and time necessary to conduct a decent audit. Some of the very large security bugs found in open source software which were present in that code for years, indicate that this is not commonly done. And that was just bugs as opposed to actual backdoors which w…

With visible source code, at least the security bugs are actual bugs instead of deliberate attacks on the users. Psychologically, people are less likely to commit antisocial acts if they think that they are being watched. So, if nothing else, having visible source code helps reducing some attacks. The more popular a particular project is, the more watched they will feel. I therefore still trust OpenVPN a lot more than I trust Juniper. Every one of its patches goes through a public code review:

https://community.openvpn.net/openvpn/wiki/DeveloperDocument...

http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?view...

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#53

Post by Kristine1975 »

azernik wrote: post #48
acd wrote: post #44

This also highlights why it would be better to use opensource firewalls such as Openbsd instead of proprietary ones! If you care about your security then you need to be able to inspect the code that protects your assets. Distributed open source firewall vs propritary firewall with backdoors.

Given that this was hidden even from the organization that was in control of the codebase, it's not clear that open source on its own is a real solution. This made it through whatever initial review processes Juniper has, and was only caught by an "internal code review" performed after the fact - an exercise only infrequently conducted on most open source projects. Given enough eyeballs backdoors can be easy to spot…

>Given enough eyeballs backdoors can be easy to spot in source code

After looking at some examples of the Underhanded C contest (http://underhanded-c.org/) and its predecessor, the Obfuscated V contest (http://web.archive.org/web/20110605000401/http://graphics.st...), I'm not so sure that well-implemented backdoors are easy to spot.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#54

Post by hyperdunc »

notalaser wrote: post #45
DanBC wrote: post #26

Earlier quoted context omitted.

That has always been the case. It's always been the case that if your adversary is a well funded government you need very careful security. We knew this from Echelon in the 1980s.

I was thinking the same thing. Honeymoon's over? What honeymoon? There never was a honeymoon!

Objectively, perhaps not. (I suppose I remember the early days of the Internet when it wasn't that popular.) My gist is that our implicit trust in the system/infrastructure we rely on is undermined by this sort of revelation. And yet, as a whole, we de facto continue to trust in opaque entities that provide valuable yet likely compromised services because it is convenient.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#55

Post by coldtea »

rtpg wrote: post #51
level09 wrote: post #39

Earlier quoted context omitted.

It can't be NSA agents who caught intercepting network gear from Cisco Systems as it was being shipped to a customer (as revealed by snowden) it is highly unlikely they infected juniper networks as well.

I don't disagree that they might have the intent to, but it's possible they didn't have the capability to. Much like the difference between forcing sites to hand over SSL certs and breaking SSL, there's a gulf between compromising hardware that you have physical access to and compromising the software stack at the source. In this case I wouldn't be surprised if that turned out to be the narrative, but the "NSA can ac…

>Much like the difference between forcing sites to hand over SSL certs and breaking SSL, there's a gulf between compromising hardware that you have physical access to and compromising the software stack at the source.

You know that they could have their own programmers working there, or just approach, bribe or blackmail, an existing programmer to compromise the software (e.g. one found with child porn on his HD).

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#56

Post by coldtea »

Buge wrote: post #9

Wow that nation state is stupid. They embedded the backdoor password right into it. Clearly they should have embedded the hash of the password instead. Then it would be unbreakable and no other party would be able to use the backdoor. Hashing passwords is extremely basic security practice.

>They embedded the backdoor password right into it

Or you know, that's just one obvious backdoor they put in, to divert from the other 2-3 non-obvious they have.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#57

Post by jacquesm »

kabdib wrote: post #38

I'll bet you ten dollars there are more backdoors, better hidden than the ones they found. Say, with Underhanded C style coding. An additional ten bucks says that Cisco and the top handful of consumer appliances also contain such backdoors. I hope the folks at Juniper are checking their toolchains, build machines and repositories for signs of similar attack. Of course, enough time has elapsed that they may need to es…

> I hope the folks at Juniper are checking their toolchains, build machines and repositories for signs of similar attack.

I hope they figure out who planted it there and that they change their hiring/code review policies to make sure that such a thing can not happen again. Firewalls should be tamper-proof to the point where they simply refuse to operate at all if the code has been messed with after it leaves the premises, the absence of such tamper proofing is already a problem and should be taken quite serious.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#58

Post by tyingq »

acd wrote: post #44

This also highlights why it would be better to use opensource firewalls such as Openbsd instead of proprietary ones! If you care about your security then you need to be able to inspect the code that protects your assets. Distributed open source firewall vs propritary firewall with backdoors.

I agree with the premise, but I'm not aware of an open source firewall that can provide the same functionality and scale as Juniper's product line.

You can certainly provide, for example, open source designs for a specialized ASIC, but it doesn't mean anyone could afford to actually make it.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#59

Post by JeremyNT »

raesene9 wrote: post #47
acd wrote: post #44

This also highlights why it would be better to use opensource firewalls such as Openbsd instead of proprietary ones! If you care about your security then you need to be able to inspect the code that protects your assets. Distributed open source firewall vs propritary firewall with backdoors.

Of course the idea that open source software in general, and firewalls in specific are better than closed source ones relies on people actually having the skills and time necessary to conduct a decent audit. Some of the very large security bugs found in open source software which were present in that code for years, indicate that this is not commonly done. And that was just bugs as opposed to actual backdoors which w…

Indeed, for those of us not taking the time (or lacking the expertise) to audit code ourselves, this is all ultimately appeal to authority.

If anything, the advantages of open source here are more about open development processes and being able to know just who is the gate keeper. As an example, if you use OpenBSD, you have reasonable assurances that Theo will do a good job, because he has earned his reputation.

Juniper? Who really knows what goes on internally? How are people allocated and shuffled around? It's a black box.

Ultimately I'd put more trust in OpenBSD than in Juniper because of this, but I'm still making a leap of faith. And OpenBSD is an extreme example of how much trust a project can earn; a vast majority of open source code is not held to such scrutiny.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#60

Post by relkor »

omni wrote: post #35
Buge wrote: post #9

Wow that nation state is stupid. They embedded the backdoor password right into it. Clearly they should have embedded the hash of the password instead. Then it would be unbreakable and no other party would be able to use the backdoor. Hashing passwords is extremely basic security practice.

When you're trying to do something secretly, you run into a new tradeoff: doing it the right way vs. doing it in such a way that it doesn't draw attention to itself. It might have been the case that hashing it would have been too flashy.

I would imagine it would hook into the existing code that is hashing the passwords... Which suggests that they are not in fact hashing the user inputs and are relying on the client to do that for them.
Post reply on HN