Unauthorized code found in Juniper firewalls

[Bernard Murphy]

Juniper Networks announced on Thursday that they had found unexpected code embedded in the OS of some of their firewalls. The code can take complete control of the firewalls and decrypt encrypted traffic on VPNs. At least one of these backdoors appears to be the work of a nation-state attacker, though no indication has been given so far which nation is suspected. Google and others are using this to highlight the dangers inherent in intended backdoors (as suggested by the NSA).

For me this also highlights the challenges and potential new opportunities in security. This is not just about encryption and trustzones and all that good stuff, all intended to defend against malware intrusions. It's also about detecting malware built into the machine from the outset. Given a complex enough value chain and enough people touching the code, this is a real possibility, as Juniper just discovered.

The Wired article is Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors | WIRED

 

[Daniel Payne]

In a similar manner, many fabless semiconductor companies want to know that the chip design that they send to the foundry comes back with only the logic they designed, and nothing else inserted by a hacker to change the behavior of the chip or take control of it remotely.

 

[Bernard Murphy]

Good point Daniel, though it seems very difficult to learn of real cases. There's a lot of academic work in this area (PUFs aka physically unclonable functions, trojan detection, watermarking and more), but the only people who seem prepared to talk about it are DARPA and some of the universities. DoD doesn't have money to fund research and the commercial companies either don't seem to care or don't want to advertise weaknesses. Difficult to progress the state of the art under these circumstances.