News for hackers. Stuff that matters.
Re:Juniper breach mystery starts to clear with new details o... by adventured on Sunday September 05, 2021 @01:21PM (#28425934)
> The NSA made Juniper use a backdoored algorithm

It's very important to clarify that the NSA didn't make them use it. The DoD required it as terms for future contracts. Juniper grabbed the money in knowing exchange for putting their customers at risk.

Why does that distinction matter? It dramatically increases Juniper's culpability in the scheme. If the DoD had actually forced them to use it, that dramatically reduces Juniper's culpability.

Re:Juniper breach mystery starts to clear with new details o... by nitrogen on Sunday September 05, 2021 @01:26PM (#28425989)
This is exactly how they "make" a company do something. Look at what happened to the Qwest (IIRC?) CEO to see what happens if you refuse these contracts.
Re:Juniper breach mystery starts to clear with new details o... by Supermancho on Sunday September 05, 2021 @01:43PM (#28426136)
https://www.eff.org/deeplinks/2007/10/qwest-ceo-nsa-punished...

If a company refuses, they are making a decision (more of a gamble). Corporations will almost universally sacrifice customer safety for profit. Especially when they are making a decision between "for sure losing opportunity money" and "maybe losing money after a court case".

That does not mean they aren't liable when things go bad.

Re:Juniper breach mystery starts to clear with new details o... by PhantomGremlin on Sunday September 05, 2021 @07:38PM (#28428795)
I hate this meme. It's false.

Nacchio simply tried to use it as an excuse. He was just throwing shit against the wall and hoping that some of it stuck. Here's his claim: he was not in a rightful state of mind when he sold his shares because of problems with his son, and the imminent announcement of a number of government contracts.

Yeah sure, I know exactly what he means. Whenever I'm not in a "rightful state of mind" the way I cope with it is to dump company stock that I'm restricted from selling. /s

Nacchio was nothing but a greedy scumbag, and he went to Federal prison because of it.

https://en.wikipedia.org/wiki/Joseph_Nacchio

Re:Juniper breach mystery starts to clear with new details o... by Scoundreller on Monday September 06, 2021 @01:00AM (#28430445)
Nobody is denying he insider traded, but was the insider trading (or other unlawful activities) of others that did comply go ignored/suppressed or otherwise swept under the rug?
Re:Juniper breach mystery starts to clear with new details o... by randombits0 on Sunday September 05, 2021 @07:28PM (#28428747)
Which is why Room 641A is filled with Juniper gear.

https://en.wikipedia.org/wiki/Room_641A

Re:Juniper breach mystery starts to clear with new details o... by creato on Sunday September 05, 2021 @10:38PM (#28429704)
That doesn't make any sense, the operators of Room 641A don't need to backdoor their own gear.
Re:Juniper breach mystery starts to clear with new details o... by Zigurd on Monday September 06, 2021 @09:12AM (#28433318)
There is an interesting aspect of the room 641a story that could turn out to be different in detail:

The Wikipedia article says, as do other accounts, that beam splitters were used to tap into fiber optic lines. That might in fact be how it was done, but I do not think that was necessary.

IIRC, Juniper core routers were (uniquely, at the time?) capable of duplicating traffic on a NIC to another NIC without performance impact on capacity as a whole. This would have made them particularly suitable for mass surveillance that would not show up in network management metrics.

Re:Juniper breach mystery starts to clear with new details o... by randombits0 on Monday September 06, 2021 @11:46AM (#28434835)
When trying to make sense of why things are the way they are, one very successful technique to use is “follow the money”.

“We want you to backdoor your product for ‘National Security’ and if you do, we’ll buy many millions of dollars worth of your gear.”

What doesn’t make sense about that?

Re:Juniper breach mystery starts to clear with new details o... by Scoundreller on Monday September 06, 2021 @01:08AM (#28430500)
Maybe in exchange for the backdoor they buy a mountain of non-backdoored versions too?
Re:Juniper breach mystery starts to clear with new details o... by foerbert on Sunday September 05, 2021 @10:11PM (#28429581)
I don't get why this is downvoted. There is a huge difference between, say, a court order or other force-backed request and a requirement in a bidding process.

It doesn't absolve the NSA of any guilt here either, but this is not a helpless Juniper giving in due to full weight and power of the government.

Re:Juniper breach mystery starts to clear with new details o... by stjohnswarts on Sunday September 05, 2021 @05:02PM (#28427757)
Exactly, if a company is willing to go to court they can't be made to build backdoors like this, at least not yet. Hence why everyone was peeved at apple for siding with the government to add government spyware to every apple phone to make sure citizens comply.
Re:Juniper breach mystery starts to clear with new details o... by pjc50 on Sunday September 05, 2021 @01:37PM (#28426076)
Were Juniper informed of the vulnerability at the time they made the decision? It appears not.
Re:Juniper breach mystery starts to clear with new details o... by wbl on Sunday September 05, 2021 @02:40PM (#28426608)
The vulnerability had been disclosed in 2007 by several independent researchers. It had also been patented by Certicom.