http://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST
Should we blame Juniper for letting a git repository open to
"unauthorized code" or should we congratulate them for their frankness
(few corporations would have admitted the problem)?
- Elevate Community | Juniper Networks
nt-about-ScreenOS/ba-p/285554
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=
SIRT_1
&actp=LIST
Should we blame Juniper for letting a git repository open to
"unauthorized code" or should we congratulate them for their frankness
(few corporations would have admitted the problem)?
I think we should do both, even if it would be interessting to know how long
the problem already exists.
I think "unauthorized code" is still plausible newspeak for "bug".
Why blame finger foo when you can blame terrorists?
Hi,
> Should we blame Juniper for letting a git repository open to
> "unauthorized code" or should we congratulate them for their frankness
> (few corporations would have admitted the problem)?
'un-authorized' - not authorized.
this could be code/idea by some/one engineer for eg debugging purpose etc that
just didnt get ANY signoff by anyone - so during code review they've questioned
its presence and not found the relevant sign-off etc.
take VW here...they are now blaming a small set of engineers who rigged the emissions
system....if they can say that no managers/execs knew about this and it was purely in
some small code team etc then that too is unauthorized code - but its internal,
not an external bad guy (it will be interesting however, in that case, whether that really
was the case and it WASNT known about by someone else...thus 'authorized' in that it wasnt
stopped)
alan
It looks like two different holes, one a back door for unauthorized
console login and one to somehow leak VPN encryption keys. There are
hints that that latter involved tinkering with certain constants in
the crypto (https://twitter.com/matthew_d_green/status/677871004354371584);
that would squarely point the finger at some government's intelligence
agency.
I don't know who did it, but neither 'bug' nor 'developer debugging
code' sounds plausible here.
That tweet got deleted, apparently to redraft/correct; is this the equivalent?
https://twitter.com/sweis/status/677897914643976193
https://gist.github.com/hdm/107614ea292e856faa81#file-ssg500-6-3-0r12-0-diff-L16
Royce
Yes. He's backing off a bit on the claim, since he doesn't have full context.
--Steve Bellovin, https://www.cs.columbia.edu/~smb
a message of 6 lines which said:
The password for the first backdoor (the one regarding telnet/SSH
access) has been published recently:
Shodan finds 26000 ScreenOS machines reachable from the Internet. It
will be a small botnet 