Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

wired.com

Post reply on HN
Print view View original

81–90 of 121 posts

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#81

Post by jkestner »

merpnderp wrote: post #66
blisterpeanuts wrote: post #61

"I am shocked—shocked—to find that gambling is going on in here!" --from "Casablanca" I'd be shocked to learn that there are no back doors in routing equipment. Having that kind of control is just too appealing to the most powerful players -- the NSA, China, perhaps Russia. One hopes that people who care about the privacy of their communications are not relying on the routers for encryption. I would encrypt end-to-en…

Wish I could up vote this more. The government has nearly nothing to show for all their surveillance and yet they keep asking for more.

Well, it's because if they had more powers they could be more effective, right? This line of logic ends only when the people stop asking for perfect security.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#82

Post by maxerickson »

hyperdunc wrote: post #54
notalaser wrote: post #45

Earlier quoted context omitted.

I was thinking the same thing. Honeymoon's over? What honeymoon? There never was a honeymoon!

Objectively, perhaps not. (I suppose I remember the early days of the Internet when it wasn't that popular.) My gist is that our implicit trust in the system/infrastructure we rely on is undermined by this sort of revelation. And yet, as a whole, we de facto continue to trust in opaque entities that provide valuable yet likely compromised services because it is convenient.

What implicit trust?

Phrases like If you want something to stay private, don't post it. are bandied about by the general public. Not just by single issue privacy advocates, but by people of all sorts.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#83

Post by rbc »

kabdib wrote: post #38

I'll bet you ten dollars there are more backdoors, better hidden than the ones they found. Say, with Underhanded C style coding. An additional ten bucks says that Cisco and the top handful of consumer appliances also contain such backdoors. I hope the folks at Juniper are checking their toolchains, build machines and repositories for signs of similar attack. Of course, enough time has elapsed that they may need to es…

It makes me wonder about their control of the software design and build process. It looks like something went really wrong with their software supply chain.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#84

Post by fabulist »

tptacek wrote: post #71

Just a quick note that 'lawnchair_larry has me dead to rights on this one. I conceded awhile ago that Dual EC was a crypto backdoor (before BULLRUN and the antics that were uncovered with RSA and with the European standards, I had suggested, as some other crypto people had, that Dual EC was too hamfisted and obvious to be a crypto backdoor). But I've maintained since then that virtually nobody uses Dual EC, so its im…

"Instead of using the NIST recommended curve points [ScreenOS] uses self-generated basis points..." [0]

The way I read this statement is that each device generates its own set of points. If this is the case, I don't see how it would work as a crypto backdoor.

If by "self-generated" they mean generated by Juniper once, well, thats fishy.

[0] http://kb.juniper.net/InfoCenter/index?page=content&id=KB282...

Edited to add: Upon further research, the latter possibility seems more likely.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#85

Post by anologwintermut »

fabulist wrote: post #84
tptacek wrote: post #71

Just a quick note that 'lawnchair_larry has me dead to rights on this one. I conceded awhile ago that Dual EC was a crypto backdoor (before BULLRUN and the antics that were uncovered with RSA and with the European standards, I had suggested, as some other crypto people had, that Dual EC was too hamfisted and obvious to be a crypto backdoor). But I've maintained since then that virtually nobody uses Dual EC, so its im…

"Instead of using the NIST recommended curve points [ScreenOS] uses self-generated basis points..." [0] The way I read this statement is that each device generates its own set of points. If this is the case, I don't see how it would work as a crypto backdoor. If by "self-generated" they mean generated by Juniper once, well, thats fishy. [0] http://kb.juniper.net/InfoCenter/index?page=content&id=KB282... Edited to add…

Instead of using the NIST recommended curve points it uses self-generated basis points and then takes the output as an input to FIPS/ANSI X.9.31 PRNG, which is the random number generator used in ScreenOS cryptographic operations."

Looks like they feed the output through a standard CPRNG. Assuming it's true, that pretty much breaks the DUAL_EC attack because you can't use the output of the final CPRNG to recover the DUAL_EC state.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#86

Post by Buge »

coldtea wrote: post #56
Buge wrote: post #9

Wow that nation state is stupid. They embedded the backdoor password right into it. Clearly they should have embedded the hash of the password instead. Then it would be unbreakable and no other party would be able to use the backdoor. Hashing passwords is extremely basic security practice.

> They embedded the backdoor password right into it Or you know, that's just one obvious backdoor they put in, to divert from the other 2-3 non-obvious they have.

But one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others. For example the DUAL_EC backdoor could only be exploited by the NSA. With this backdoor, now China and everyday criminals can also use it.

I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#87

Post by Retric »

blisterpeanuts wrote: post #80
pyvpx wrote: post #69

Earlier quoted context omitted.

I read from a reliable source I cannot immediately recall that she in fact did not post anything jihadist or even inflammatory on any social media account of hers. are you repeating a convenient falsehood or am I? in other words -- do you have a source that verified she in fact posted jihadist anything, anywhere?

You are right. The FBI has corrected the report of her Facebook warnings that was floating around the news networks. Marquez (the Muslim convert who sold them the guns), however, did post something on his verified Facebook account a month before the attack.[1] And Malik (the wife) did apparently post something on Facebook minutes before the attack. Do you disagree with my overall point, that the U.S. law enforcement…

Surveillance is simply a useful scapegoat it's actually fairly useless. The problem is if there are any read flags that get 24/7 monitoring then having several people flip them will quickly destroy the system.

Let's say they vent in private conversation well that's legal, they then buy some guns and ammo. Well again that's legal. Then one day they go out and shoot people, well sorry we can't afford to have a swat team around and you can go from 100% legal to shooting people in about 30 seconds.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#88

Post by nomel »

blisterpeanuts wrote: post #61

"I am shocked—shocked—to find that gambling is going on in here!" --from "Casablanca" I'd be shocked to learn that there are no back doors in routing equipment. Having that kind of control is just too appealing to the most powerful players -- the NSA, China, perhaps Russia. One hopes that people who care about the privacy of their communications are not relying on the routers for encryption. I would encrypt end-to-en…

But they say,

> To be clear, we do not work with governments or anyone else to purposely introduce weaknesses or vulnerabilities into our products…

Can we assume they can force a software modification in the interest of national security, just as we know they can force taps into the likes of Yahoo and AT&T?

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#89

Post by hueving »

coldtea wrote: post #56
Buge wrote: post #9

Wow that nation state is stupid. They embedded the backdoor password right into it. Clearly they should have embedded the hash of the password instead. Then it would be unbreakable and no other party would be able to use the backdoor. Hashing passwords is extremely basic security practice.

> They embedded the backdoor password right into it Or you know, that's just one obvious backdoor they put in, to divert from the other 2-3 non-obvious they have.

That's not a good idea if you're hiding a backdoor. The last thing you want is for people to have a reason to audit the code base.

Re: Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors

#90

Post by tyingq »

tyingq wrote: post #58
acd wrote: post #44

This also highlights why it would be better to use opensource firewalls such as Openbsd instead of proprietary ones! If you care about your security then you need to be able to inspect the code that protects your assets. Distributed open source firewall vs propritary firewall with backdoors.

I agree with the premise, but I'm not aware of an open source firewall that can provide the same functionality and scale as Juniper's product line. You can certainly provide, for example, open source designs for a specialized ASIC, but it doesn't mean anyone could afford to actually make it.

Mmm. For those downvoting, it's fairly easy to compare features and throughput. The pfSense team is making great strides, and has a roadmap that starts to close the gap.

But, there is a notable gap. Compare throughput for a 3DES vpn for example. Or total throughput with filtering on.

Post reply on HN