position:security analyst

schrödinger @erratic 22/12/2015

1

1

Juniper Backdoor
__________________
Cisco Starts Company-Wide Code Audit to Search for Hidden Backdoors
After Juniper found “unauthorized code” in the source code of their ScreenOS, deployed with NetScreen firewall equipment, Cisco announced a full audit of all their products’ source code.
▻http://news.softpedia.com/news/cisco-starts-reviewing-code-after-juniper-finds-hidden-backdoor-4979
The code reviewers will be looking for undisclosed device access methods (backdoors), hardcoded or undocumented hidden account credentials, undocumented traffic diversions, or any type of covert communications initiated from the device.
Cisco has firmly stated that it has a “no backdoor” policy for its products, and has also reassured clients that, up to this point, no unauthorized code has been found in its devices.
[...]
It appears that the Juniper incident has rocked the communications equipment market, and now, many companies are scrambling left and right to reassure clients that their businesses’ communications channels are safe.
About the Juniper Backdoor (in some of their firewalls):
Security Firm Discovers Backdoor Password for Juniper ScreenOS Devices
▻http://news.softpedia.com/news/security-firm-discovers-backdoor-password-for-juniper-screenos-devic
The issue was present only in some of its equipment, NetScreen devices using ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20, to be more precise.
According to Rapid7, attackers can use the password “<<< %s(un=’%s’) = %u” to bypass both SSH and Telnet authentication procedures, with the only condition that they know a valid username.
The password was found in the ScreenOS code, and it looks like a code comment, probably the reason it remained in the code for so many years.

According to security analyst Ralf-Philipp Weinmann [1], these vulnerabilities could find their source in NSA’s deliberately crippled dual elliptic curve algorithm Dual_EC_DBRG, a pseudo-random number generator used to encrypt traffic.
A Wired article also explains how the backdoor works:
▻http://www.wired.com/2015/12/researchers-solve-the-juniper-mystery-and-they-say-its-partially-the-nsas-fau

Apparently, Juniper is still using this weakened algorithm.
#Cisco
#Juniper #NetScreen #ScreenOS
#backdoor
#spy
#NSA
___
[1] ▻http://rpw.sh/blog/2015/12/21/the-backdoored-backdoor

schrödinger @erratic
- schrödinger @erratic 22/12/2015
  
  More info on the Juniper backdoor, by Juniper itself
  ▻http://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
  and
  ▻http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&actp=search
  And an article in Der Spiegel from 2013 already mentioned the NSA having a toolbox called FEEDTHROUGH, which is used to keep two kinds of software implants on a Juniper NetScreen firewall. The technique is aimed at keeping the software implants on the device even if it reboots or is upgraded.
  ►http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html
  (and ▻http://seenthis.net/messages/211934 by @liotier)
  This malware burrows into Juniper firewalls and makes it possible to smuggle other NSA programs into mainframe computers. Thanks to FEEDTROUGH, these implants can, by design, even survive “across reboots and software upgrades.” In this way, US government spies can secure themselves a permanent presence in computer networks. The catalog states that FEEDTROUGH “has been deployed on many target platforms.”
  
  schrödinger @erratic
- schrödinger @erratic 23/12/2015
  
  voir aussi : ▻http://seenthis.net/messages/442784
  
  schrödinger @erratic
- schrödinger @erratic 25/12/2015
  
  Juniper backdoor already being exploited
  SANS ISC set up a SSH honeypot simulating the Netscreen backdoor to see if the backdoor was being exploited. And it is.
  ▻https://isc.sans.edu/forums/diary/First+Exploit+Attempts+For+Juniper+Backdoor+Against+Honeypot/20525
  Our honeypot doesn’t emulate ScreenOS beyond the login banner, so we do not know what the attackers are up to, but some of the attacks appear to be ’manual’ in that we do see the attacker trying different commands
  With over 26,000 NetScreen devices that run the vulnerable versions of ScreenOS, this puts hundreds or thousands of companies at serious risk.
  
  schrödinger @erratic
- schrödinger @erratic 10/01/2016
  
  Juniper will replace Dual_EC and ANSI X9.31 in ScreenOS with other random number generating software already used on JunOS software.
  ▻http://forums.juniper.net/t5/Security-Incident-Response/Advancing-the-Security-of-Juniper-Products/ba-p/286383
  In addition to removing the unauthorized code and making patched releases available, Juniper undertook a detailed investigation of ScreenOS and Junos OS® source code.
  After a detailed review, there is no evidence of any other unauthorized code in ScreenOS nor have we found any evidence of unauthorized code in Junos OS. The investigation also confirmed that it would be much more difficult to insert the same type of unauthorized code in Junos OS
  We have identified additional changes Juniper will make to ScreenOS to enhance the robustness of the ScreenOS random number generation subsystem
  We will replace Dual_EC and ANSI X9.31 in ScreenOS 6.3 with the same random number generation technology currently employed across our broad portfolio of Junos OS products..
  
  schrödinger @erratic
Écrire un commentaire
ccoVeille @ccoveille 18/01/2015

It’s The Beginning Of The End For Windows 7
▻http://readwrite.com/2015/01/14/microsoft-windows-7-obsolescence-end-support
http://a2.files.readwrite.com/image/upload/c_fill,dpr_1.0,q_80,w_620/MTI3Mzk0MzcwMzY1MjEyNjgy.jpg
So long, Windows 7. After six years, Microsoft has started phasing out this version of its desktop operating system.Independent security analyst Graham Cluley points out that “mainstream support” for Windows 7 Service Pack 1 has just ended, according to this Microsoft webpage. However, if you bought a PC with this version last October, when the last Windows 7 consumer computers shipped, don’t despair: At least extended support will continue for another five years. Microsoft explains that extended support covers critical security updates, so current users will still be able to receive those. Mainstream support covered those patches along with new features and free technical support.Extended support for Windows 7 will expire on January 14, 2020. Launched on July 22, 2009, Windows 7 (...)
http://a2.files.readwrite.com/image/upload/c_fill,dpr_1.0,h_380,q_80,w_630/MTI3Mzk0MzcwMzY1MjEyNjgy.jpg
ccoVeille @ccoveille
Écrire un commentaire