This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
No, that's expected behavior and will eventually happen approaching the limit of 100% of the time.
Even worse, a backdoor is often a greater security risk than normal authorization because the backdoor can often access all the data, not just a single user's data.
In short, if you are in government, do not ask for backdoors, if you are in the private sector do not make backdoors. Backdoors are a flawed idea that leads to very bad things for everyone (private sector losses hit government in the pocketbook, too).
A backdoor rekey attack, if it lets the attacker gain a foothold that allows them continued access after the attack is detected. That is really bad!
With a smack of ham to it. I call it hot ham water.
Hope this sort of thing keeps happening. I want more concrete examples to cite when people defend this stupidity. I want the governments of the world to be too embarrassed to talk about cryptography ever again, least of all demand backdoors into private infrastructure.
They're too far gone if they still believe "if you have nothing to hide, you have nothing to fear" so openly.
You can argue that is was a software problem, not a hardware problem. This is wrong. It was a human problem. The humans involved span the software and hardware and more across all models.
No, I'm not being serious. Obviously what dheera is referring to is not software vs hardware but rather what hardware is affected. To comment that it's the hardware that is running the software that is infected is hardly useful.
It was a game of telephone gone horribly wrong, and Bloomberg's reputation is shot since they have refused to retract it.
This isn't a true statement, if strictly read--there are many techniques to hide undocumented components on boards, and covering all of them requires more than just a pass under a SEM. There's a fun talk that goes over a lot of them here: https://www.youtube.com/watch?v=RqQhWitJ1As
Do you really need it explained why that's far fetched? I'm going to let you think on that a bit longer. It should have kicked in by now.
It's very important to clarify that the NSA didn't make them use it. The DoD required it as terms for future contracts. Juniper grabbed the money in knowing exchange for putting their customers at risk.
Why does that distinction matter? It dramatically increases Juniper's culpability in the scheme. If the DoD had actually forced them to use it, that dramatically reduces Juniper's culpability.
If a company refuses, they are making a decision (more of a gamble). Corporations will almost universally sacrifice customer safety for profit. Especially when they are making a decision between "for sure losing opportunity money" and "maybe losing money after a court case".
That does not mean they aren't liable when things go bad.
Nacchio simply tried to use it as an excuse. He was just throwing shit against the wall and hoping that some of it stuck. Here's his claim: he was not in a rightful state of mind when he sold his shares because of problems with his son, and the imminent announcement of a number of government contracts.
Yeah sure, I know exactly what he means. Whenever I'm not in a "rightful state of mind" the way I cope with it is to dump company stock that I'm restricted from selling. /s
Nacchio was nothing but a greedy scumbag, and he went to Federal prison because of it.
The Wikipedia article says, as do other accounts, that beam splitters were used to tap into fiber optic lines. That might in fact be how it was done, but I do not think that was necessary.
IIRC, Juniper core routers were (uniquely, at the time?) capable of duplicating traffic on a NIC to another NIC without performance impact on capacity as a whole. This would have made them particularly suitable for mass surveillance that would not show up in network management metrics.
“We want you to backdoor your product for ‘National Security’ and if you do, we’ll buy many millions of dollars worth of your gear.”
What doesn’t make sense about that?
It doesn't absolve the NSA of any guilt here either, but this is not a helpless Juniper giving in due to full weight and power of the government.