News for hackers. Stuff that matters.

A comment on Juniper Networks will drop code tied to National Security Agency. Parent comment

Re:Juniper Networks will drop code tied to National Security... by sandworm101 on Saturday January 09, 2016 @01:47PM (#10872339)
It doesn't really matter imho what the NSA did or did not do in relation to the code. What matters is what they could have done once that code was in place.

Given the revelations of recent years, we must assume that they exploited anything they could. Even if they didn't, that is still the prudent security assumption to make. Juniper speaks of a "knowledgeable attacker". Who is more knowledgeable an attacker than NSA? Perhaps Juniper employees? And how many are now working at/for NSA or some like agency?

This is the problem with secret organizations that are willing to spin stories and tell lies. The only prudent option is to fill all the blank spots in out knowledge with worst case scenarios. Maybe NSA had nothing to do with this, but there is nothing they or Juniper can say to substantiate that fact because they are no longer completely trustworthy. Math, code, these are not lies.

[ Parent | on HN ]
Re:Juniper Networks will drop code tied to National Security... by tptacek on Saturday January 09, 2016 @03:06PM (#10872653)
No, that's not how this backdoor works. If NSA didn't implant it, they don't have the private key corresponding to the parameters hardcoded into the software. That's why it's called a "NOBUS backdoor"; it's cryptographically locked to whoever implants it.
[ Parent | on HN ]
Re:Juniper Networks will drop code tied to National Security... by sandworm101 on Saturday January 09, 2016 @03:50PM (#10872821)
We don;t know that yet. This may have been the case of nsa-supported standards/devices/code being integrated without the agency being directly involved. Or it could have been a known tap put in place by someone without authority so to do. Either way, NSA may have access to things they don't even realize until they scan for whether their door has been installed.

Beyond juniper, This is a growing worry amongst open source projects.

[ Parent | on HN ]
Re:Juniper Networks will drop code tied to National Security... by tptacek on Saturday January 09, 2016 @05:09PM (#10873100)
You think Dual EC is a worry for open source projects?

Can you find any open source projects that use it? Or ever have used it?

[ Parent | on HN ]
Re:Juniper Networks will drop code tied to National Security... by sandworm101 on Saturday January 09, 2016 @06:03PM (#10873232)
Not DuelEC specifically, the concept that someone like NSA might be out there promoting open code or standards with known faults, even backdoors, in hope that they will be integrated without proper evaluation.
[ Parent | on HN ]
Re:Juniper Networks will drop code tied to National Security... by tptacek on Sunday January 10, 2016 @01:56PM (#10876578)
NSA doesn't need to do anything like this. Watch the CFRG standards process some time, or anywhere else on the IETF. They can sit back and let the standards committees do this stuff for them.
[ Parent | on HN ]