Juniper breach mystery starts to clear with new details on hackers and U.S. role

Re:Juniper breach mystery starts to clear with new details o... by NelsonMinar on Sunday September 05, 2021 @02:46PM (#28426657)

For its first 50 years or so NSA had a dual mission: protect the US from spying while spying on others. But these last 20 years they've undermined that first mission. They've now attacked and weakened American technology so many times that you'd be crazy to trust anything the NSA offers to make you more secure. It doesn't help when they lose control of their own hacking tools igniting a major expansion in ransomware.

I don't think America can ever recover from this breach of trust. Maybe NSA just needs to be shut down entirely. Or at least redefined explicitly as an adversarial agency to everyone.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by caeril on Sunday September 05, 2021 @04:07PM (#28427328)

> you'd be crazy to trust anything the NSA offers to make you more secure

You'd also be crazy to trust anything made by American gear vendors. This is not the only instance of this, just one of the ones for which FVEY got caught.

Is non-US gear also compromised? Yeah, probably. But the PLA and the GRU can't physically confine you to an 8x8 steel cage on trumped-up charges predicated on the data they exfil from your network.

Your best bet is to buy gear from countries either not-friendly or actively hostile to the country you're in. Sure, you're probably pwned, but they're not sending a SWAT team in an MRAP to shoot your dog, either.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by swiley on Sunday September 05, 2021 @06:35PM (#28428437)

Your best bet is to use things developed entirely in the open. Even if that compromises performance.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by simiones on Monday September 06, 2021 @08:33AM (#28433050)

That doesn't help if you're trying to be safe from a powerful world government - one with the resources and will to infiltrate an open project for its own ends. It's far less likely that there are US backdoors in Huawei routers (which surely contain Chinese backdoors!) than in any mostly american open-source software you pick.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by swiley on Monday September 06, 2021 @05:32PM (#28438346)

Huawei routers are well known to be backdoored by the Chinese government. If you’re worried about attacks from nations then you can only build things yourself from scratch, your next best option is things done in the open since the bar for hiding back doors is much higher.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by SkyMarshal on Sunday September 05, 2021 @10:18PM (#28429615)

>But the PLA and the GRU can't physically confine you to an 8x8 steel cage on trumped-up charges predicated on the data they exfil from your network.

Actually they can, and with less legal recourse for you than in the US. It just depends on where in the world you happen to be when they decide they want you.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by arcticfox on Sunday September 05, 2021 @11:58PM (#28430075)

Why bother with cages when you can go straight to Novichoking someone's underpants?

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by jvanderbot on Tuesday September 07, 2021 @11:25AM (#28445987)

It is entirely nonsensical to me that buying from alibaba would save you from an overly-inquisitive domestic government.

In any country, you'll end up in a steel cage regardless of whether you bought your computer or software from the KGB, NSA, or a homemade kit in a bazaar in Nicaragua made by a kid from Chile.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by spockz on Sunday September 05, 2021 @05:15PM (#28427877)

Would you be safe by running multiple layers around your network? Each layer from a different vendor?

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by tim-- on Sunday September 05, 2021 @06:39PM (#28428457)

It depends on your threat level.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by kafkaIncarnate on Sunday September 05, 2021 @05:06PM (#28427795)

"You either die a hero, or live long enough to see yourself become the villain." -Harvey Dent

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by mark_l_watson on Sunday September 05, 2021 @03:57PM (#28427245)

You are correct, and the transition point was 9/11. Before that the NSA was doing good work shoring up our digital infrastructure, as well as working with the FBI to go after international crime syndicates. I wish we could get back to that.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by the_rectifier on Sunday September 05, 2021 @04:10PM (#28427355)

Not at all, it was focused on implementing backdoors and surveillance for decades before that.

[ Parent | on HN ]

Re:Juniper breach mystery starts to clear with new details o... by craftinator on Sunday September 05, 2021 @09:47PM (#28429464)

> Before that the NSA was doing good work shoring up our digital infrastructure

Yeah, like introducing the Clipper chip!

[ Parent | on HN ]