Congressional oversight leaders are requiring most federal agencies to audit their networks to see if they use Juniper-manufactured firewalls that for four years contained an unauthorized backdoor for eavesdropping on encrypted communications.
Members of the House of Representatives Committee on Oversight and Government Reform gave the agencies until February 4 to produce documents showing whether they use Juniper’s NetScreen line of firewall appliances. The committee is also requiring agency heads who used the vulnerable devices to show how they learned of the eavesdropping threat and whether they fixed it prior to the release of last month’s patch. That update removed the unauthorized code from ScreenOS, the operating system that manages NetScreen firewalls.
The Committee on Oversight and Government Reform is the chief oversight body for the US House of Representatives, with broad authority to investigate most matters pertaining to federal agencies. Committee members informed agency heads of the eavesdropping-related investigation involving Juniper hardware in letters dated late last week.
The investigation comes five weeks after Juniper officials dropped a bombshell advisory informing customers ScreenOS versions from 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 contained unauthorized code that surreptitiously decrypts traffic sent through virtual private networks. The code, the company warned, allowed people with knowledge of the backdoor to gain administrative access to NetScreen devices and to decrypt VPN connections. Among other things, the backdoor contained the hardcoded password <<< %s(un='%s') = %u—a passcode that was designed to resemble debug code to evade detection during review.
Two weeks ago, Juniper officials said, in addition to last month’s patch, they would remove the Dual_EC_DRBG random number generator from NetScreen products. The function was created by the National Security Agency, and documents provided by former NSA subcontractor Edward Snowden indicated it contains a backdoor that allows for the cracking of encryption keys derived from it. Juniper said it would drop Dual_EC_DRBG in the first half of 2016.
The random number generator was added to NetScreen around 2009, some two years after researchers presented convincing evidence it contained the backdoor.
Researchers have yet to conclusively attribute the Juniper backdoor to a specific group, but the links to Dual_EC_DRBG and other clues are prompting many to point to the NSA. It will be worth monitoring the responses agencies send to the oversight committee members to see if official US communications were exposed by the backdoor.
SOURCE: Dan Goodin | Ars Technica