Encryption Backdoor Debate Heats Up With Juniper Breach Discovery
As evidence mounts that an intelligence agency had the capability to wiretap Juniper network hardware, technology experts resist political pressure to to make encryption breakable.
The mystery surrounding two backdoors in Juniper's virtual private networking (VPN) products—and whether one of them may have originated with a U.S. intelligence agency—has added fuel to the debate surrounding government access to communications and data. On Dec. 17, Juniper announced that an internal code review had revealed that two backdoors had been added to its ScreenOS operating system. One intentionally introduced flaw allows attackers to use a hard-coded password to gain administrative rights to vulnerable systems while the other allows the decryption of communications captured by an attacker who knows a unique key. Juniper's Security Incident Response Team "is not aware of any malicious exploitation of these vulnerabilities; however, the password needed for the administrative access has been revealed publicly," the company stated in an advisory. The hard-coded password was apparently introduced in ScreenOS 6.2.0r15, released by Juniper in September 2012, while an attacker inserted the decryption bypass vulnerability into ScreenOS 6.2.0r17, released in May, according to Juniper. Versions of the operating system released as far back as August 2012 have, however, been patched for the issue.
Security researchers have linked the capability to decrypt communications to a backdoor surreptitiously supported by the U.S. National Security Agency and incorporated into products sold by security firm RSA. The company was reportedly paid $10 million for including the broken Dual Elliptic Curve (DualEC) pseudo random number generator (PRNG) in its products.