FBI, DHS investigating Juniper hack; secret backdoor dates back 3 years

Juniper Networks’ announcement of discovering “unauthorized code” in its software which could allow attackers to take over machines and decrypt VPN traffic has shaken up more than the security world; the Department of Homeland Security and the FBI are reportedly involved in investigating the backdoor.

After Juniper warned that attackers could exploit the “unauthorized code” in order “to gain administrative access to NetScreen devices and to decrypt VPN connections,” and then wipe the logs to remove any trace of a compromise, an unnamed senior official told Reuters that the Department of Homeland Security is involved in Juniper’s investigation.

Juniper claims it has best-in-class security products that “U.S. intelligence agencies require,” and those solutions are touted as providing trusted network infrastructure to the U.S. federal government. In fact, CNN pointed out that Juniper sells its equipment to the Department of Defense, the Department of Justice, the Treasury Department, and the FBI. Juniper’s products are so widely used by the U.S. government that Homeland Security is reportedly trying to determine just exactly how many Juniper systems are used by the government.

CNN added:

It’s not yet clear what if any classified information could be affected, but U.S. officials said the Juniper Networks equipment is so widely used that it may take some time to determine what damage was done.

Although Juniper hasn’t said how long ScreenOS has been backdoored, Network World’s Tim Greene pointed out that the some of the code Juniper patched dates back to August 2012. John Pironti, president of IP Architects, told Greene that since Juniper pins the problem on “unauthorized code,” he suspects an implant. “Unauthorized code, to me, means an implant,” Pironti stated. “It’s not like someone fat-fingered an entry.”

CNN also reported that the backdoor in Juniper products went unnoticed for three years, but there was no mention of an implant. Instead, CNN said it would take sophisticated attackers to “alter millions of lines of source code” to create a secret door that went undetected for three years. An unnamed U.S. official described the rogue code to CNN as being akin to “stealing a master key to get into any government building.” The U.S. federal government suspects the breach is the work of foreign government hackers, with China and Russia at the top of the list of suspects.

Twitter was on fire about the two backdoors in Juniper’s products; ImperialViolet put together a post which contains tweeted conversations by people who pulled apart the differences in Juniper’s fixed firmware versions. To explain one discovery of “EC PRNG KAT failure,” ImperialViolet wrote:

“EC PRNG” suggests that the value might be a constant in an elliptic-curve based pseudo-random number generator. That could certainly explain how passive decryption of VPN traffic was possible because it brings up memories of Dual-EC. Dual-EC was an NSA effort to introduce a backdoored pseudo-random number generator (PRNG) that, given knowledge of a secret key, allowed an attacker to observe output from the RNG and then predict its future output. If an attacker can predict the output of the PRNG then they can know the keys that one or both sides of a VPN connection will choose and decrypt it.

Juniper has a page explaining “that the VPN devices in question here ‘do utilize Dual_EC_DRBG, but do not use the pre-defined points cited by NIST’.”

ImperialViolet noted Juniper “used a backdoored RNG but changed the locks. Then this attack might be explained by saying that someone broke in and changed the locks again.”

Whatever is eventually discovered about the bad code, you should not hesitate before deploying the critical patches. As Tim Greene pointed out, attackers who are not responsible for creating the backdoors are hard at work reverse-engineering, so any unpatched devices can be exploited. Pironti told Greene that bad guys will use the reverse-engineered exploits “for years.” Since the logs can be erased, an attack could be untraceable and nearly invisible.

Tod Beardsley, Principal Security Research Manager at Rapid7, said in an email:

Virtual Private Networks (VPNs) make a cryptographic promise of privacy and data security — meaning that users and organizations give VPNs relatively unrestricted access to their data. In the case of Juniper’s VPN, privacy has been absent given the possibility of attackers monitoring customers communications, posing significant risk to those using the solution as a secure channel.

Because of this, customers should not only update, but should seriously consider the impact of changing all their possibly exposed passwords, and conduct their own investigations on their own networks, specifically looking for user account-based compromises.