[deleted]
Juniper breach mystery starts to clear with new details on hackers and U.S. role
21–30 of 180 posts
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#22This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
This smacks way more of "well, what did you expect would happen?" than surrealism. If you introduce a vulnerability, it is nothing but hubris to think that you'll be the only one to leverage the vulnerability.
Kind of, but my reading of it is that it was also a supply-side chain attack where they modified the constant that was used in the code before the binary was built. So at that level of access, I'm not sure any algorithms would hold up. I don't think Dual ECDRGB was used to attack the source control system.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#23This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
Is there a list of exactly what equipment (model numbers) was breached?
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#24The Pulse Secure exposure is pretty scary. If you have to comply with stupid Federal security requirements, Pulse and Cisco are pretty much the main players. Pulse is a steaming turd without back doors.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#25This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
> The NSA made Juniper use a backdoored algorithm It's very important to clarify that the NSA didn't make them use it. The DoD required it as terms for future contracts. Juniper grabbed the money in knowing exchange for putting their customers at risk. Why does that distinction matter? It dramatically increases Juniper's culpability in the scheme. If the DoD had actually forced them to use it, that dramatically reduc…
Were Juniper informed of the vulnerability at the time they made the decision? It appears not.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#26This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
> That's surreal.
No, that's expected behavior and will eventually happen approaching the limit of 100% of the time.
Even worse, a backdoor is often a greater security risk than normal authorization because the backdoor can often access all the data, not just a single user's data.
In short, if you are in government, do not ask for backdoors, if you are in the private sector do not make backdoors. Backdoors are a flawed idea that leads to very bad things for everyone (private sector losses hit government in the pocketbook, too).
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#27We are playing with a slippery slope! A backdoor is a backdoor. Honestly it is getting to the point where open source is the only way to go - imo. I'd like to be able to perform SAST scans and code review on all software that protects my enclaves.
Most open source crypto code just does what NIST and DJB say to do. There's no magic imparted by it being FOSS.
I agree and that's pretty sad. FOSS gives the opportunity to code review.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#28This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
Is there a list of exactly what equipment (model numbers) was breached?
It is software not hardware, so whatever model used the software.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#29This is a great example of why more operators should adopt white box solutions.
It would be interesting to see a refreshed view of what products white-box is able to replace. I recall that Juniper and Cisco were hard to replace for some products because the performance edge was in proprietary ASICs that aren't available to white box builders. I suspect that CPU improvements and things like user-space networking (DPDK and friends) might have closed the gap some, but I haven't seen any recent anal…
i doubt you are able to get the same features out of whitebox hardware.
Juniper's core routers have neat features in terms of redundancy. failing over a FPC (card with ASIC) to another routing engine(control plane) without downtime or packet flow impact is a big one. Performance might be there on the lower end (Another example is QoS/CoS without impacting performance or queues. These are the kind of things you cannot handle at the CPU without impacting traffic performance, which bites you when you are doing major traffic flows.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#30Earlier quoted context omitted.
> The NSA made Juniper use a backdoored algorithm It's very important to clarify that the NSA didn't make them use it. The DoD required it as terms for future contracts. Juniper grabbed the money in knowing exchange for putting their customers at risk. Why does that distinction matter? It dramatically increases Juniper's culpability in the scheme. If the DoD had actually forced them to use it, that dramatically reduc…
This is exactly how they "make" a company do something. Look at what happened to the Qwest (IIRC?) CEO to see what happens if you refuse these contracts.
https://www.eff.org/deeplinks/2007/10/qwest-ceo-nsa-punished...
If a company refuses, they are making a decision (more of a gamble). Corporations will almost universally sacrifice customer safety for profit. Especially when they are making a decision between "for sure losing opportunity money" and "maybe losing money after a court case".
That does not mean they aren't liable when things go bad.