C'mon man, that was 5-6 years ago!
Juniper breach mystery starts to clear with new details on hackers and U.S. role
71–80 of 180 posts
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#72For its first 50 years or so NSA had a dual mission: protect the US from spying while spying on others. But these last 20 years they've undermined that first mission. They've now attacked and weakened American technology so many times that you'd be crazy to trust anything the NSA offers to make you more secure. It doesn't help when they lose control of their own hacking tools igniting a major expansion in ransomware.…
> you'd be crazy to trust anything the NSA offers to make you more secure
You'd also be crazy to trust anything made by American gear vendors. This is not the only instance of this, just one of the ones for which FVEY got caught.
Is non-US gear also compromised? Yeah, probably. But the PLA and the GRU can't physically confine you to an 8x8 steel cage on trumped-up charges predicated on the data they exfil from your network.
Your best bet is to buy gear from countries either not-friendly or actively hostile to the country you're in. Sure, you're probably pwned, but they're not sending a SWAT team in an MRAP to shoot your dog, either.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#73How many more back-doors like that are out there that are not in public domain yet? And can we trust standard committees who, funded by public, put back doors in encryption and weaken security of public services?
No, you can't trust NIST on security. They've certified algorithms they must have known were deliberately weakened in every generation: DES in the 1970s, the Clipper chip in the 80s, "export-grade" RSA in the 90s, and broken RNGs in the 2000s. The deliberate weakening generally comes from the NSA, but NIST is required to work with them on security standards. A number of reputable security researchers claim that NIST'…
I think this is a little unfair to NIST. Some parts aren't entirely factual. For example while DES was specified at 56 bits if we discount parity bits, I'm not sure how much choice they had in this - I suspect NSA/US gov more widely here. NSA, which is distinct from NIST but obviously works with them, requested changes to the DES S-Boxes during design that resulted in better protection from differential cryptanalysis, a technique unknown to anyone else at the time. So the NSA weakened DES in one way but strengthened it in another.
A lot of this weakening of ciphers was US government policy at the time: crypto was considered only to have military applications so in the same way foreign countries don't get the full US-edition fighter jet, they also didn't get the full crypto.
DualEC was a mess, no doubt, and should never have been standardized. I'm guessing they were railroaded by NSA. What is bizarre is that everyone knew it sucked. Not only the backdoor potential but also that it was slow. In fact the backdoor was even patented: https://worldwide.espacenet.com/publicationDetails/biblio?CC... which is my personal favorite part of the saga.
So while DualEC was a mess and the export policy was disliked, generally speaking the NIST process for standardising things is widely regarded.
Of course that does not mean you should trust them blindly, but examine the evidence. AES, SHA3, the lightweight crypto competition and the pqc process will all produce ciphers from largely non-US scientists and there are detailed discussions on the forums and at the workshops.
Of course if they decide to shut down these forums for discussion or ignore community consensus then there are definitely reasons to worry.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#74Already discussed a fair bit two days ago: https://news.ycombinator.com/item?id=28404219
Thanks! Macroexpanded:
The NSA's Backdoor in Dual EC - https://news.ycombinator.com/item?id=28404219 - Sept 2021 (87 comments)
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#75For its first 50 years or so NSA had a dual mission: protect the US from spying while spying on others. But these last 20 years they've undermined that first mission. They've now attacked and weakened American technology so many times that you'd be crazy to trust anything the NSA offers to make you more secure. It doesn't help when they lose control of their own hacking tools igniting a major expansion in ransomware.…
You are correct, and the transition point was 9/11. Before that the NSA was doing good work shoring up our digital infrastructure, as well as working with the FBI to go after international crime syndicates. I wish we could get back to that.
Not at all, it was focused on implementing backdoors and surveillance for decades before that.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#76Earlier quoted context omitted.
This smacks way more of "well, what did you expect would happen?" than surrealism. If you introduce a vulnerability, it is nothing but hubris to think that you'll be the only one to leverage the vulnerability.
Kind of, but my reading of it is that it was also a supply-side chain attack where they modified the constant that was used in the code before the binary was built. So at that level of access, I'm not sure any algorithms would hold up. I don't think Dual ECDRGB was used to attack the source control system.
The brilliant part is that they did it in a way that remained undetected for so long. And the reason they could do that is because the backdoor already existed.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#77> Members of a hacking group linked to the Chinese government called APT 5 hijacked the NSA algorithm Just wanted to acknowledge how brilliant that is. They could have made any other code change, but it was genius using NSA's own backdoor. NSA advocated for that backdoor to be included in the standards. The US government then would be embarrassed and would want to cover up any issues related to it, including the fact…
There were two backdoors that were discovered at the time btw, the other one was a hardcoded password that could get you in any router (or something like that?) Odds are that there are more that weren't caught.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#78This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
It's not groundbreaking: it happened again and again.
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#79never roll your own crypto, except maybe sometimes ...
Re: Juniper breach mystery starts to clear with new details on hackers and U.S. role
#80Earlier quoted context omitted.
It would be interesting to see a refreshed view of what products white-box is able to replace. I recall that Juniper and Cisco were hard to replace for some products because the performance edge was in proprietary ASICs that aren't available to white box builders. I suspect that CPU improvements and things like user-space networking (DPDK and friends) might have closed the gap some, but I haven't seen any recent anal…
The main leap for whitebox is AES-NI for SSL/TLS offload. Nobody is really using DPDK/NETMAP in OSS products from what I can tell. Netgate is doing TNSR, but its not open source: https://www.netgate.com/tnsr-applications/edge-routing
Check out vyos.net