This seems to be "The NSA (?history of elliptic curve hackery) added code to enable them to snoop on VPNs running on Juniper routers and juniper think they fixed it but didn't"
Are the routers now locked down? Will we ever know? How on earth did someone add to their binary?
Is there a bigger picture here?
The first thing I think of is phone basebands. If they're hacking enterprise firewalls I have to assume they've already exploited the baseband in the vast majority of phones. It's the one place they can stick a software plant over the airwaves.
I think it's time to call for open source basebands, anything else just isn't safe anymore.
Not sufficient, perhaps, but necessary. A 0-day in baseband firmware seems a helluva lot more attractive a target than in a battery controller MCU.
If you don't have a remotely exploitable vulnerability, it doesn't scale to global panopticon levels.
Every time I hear someone asking for some improvement in openness and security, someone jumps in to point out how something else will circumvent it. Fine -- but how is anything going to get done if we sit paralysed a proliferation of worries?
What do you mean by this? The statement seems to imply they had to ask for permission from someone other than themselves?
This.
Phone basebands, the Intel ME[1], NICs, Windows, anything from Cisco; they all have to be considered broken.[1] With Linux, at least there is a public code history, but considering the value of the target, tricky code can't be ruled out, nor can attacks at the distribution/packaging layer.
Vernor Vinge wrote a fun book called _Deepness in the Sky_, which, among other things, explores some implications of untrustworthy computing.
[1] And plenty of things not on that list, and perhaps something on it isn't. But for some risk models, they have to be assumed broken.