https://www.theguardian.com/technology/2015/dec/22/juniper-networks-flaw-vpn-government-data
Two security flaws that lay undiscovered in Juniper Networks’ widely used corporate virtual private network (VPN) software for three years could have exposed sensitive informative to foreign governments or criminal groups, researchers have said.
The vulnerabilities were in the form of “unauthorised code” discovered during a recent internal code review and announced on 17 December. One of the flaws could have allowed hackers to decrypt information passing through Juniper’s devices, including equipment for a secure network used by companies internally.
“Whoever planted it would have access to all the VPN traffic,” said Seth Rosenblatt, managing editor of the security and privacy site the Parallax. “Data that the VPN user thought was protected from prying eyes may have been spied on.”
The FBI is reportedly investigating the breach, which could be the work of a foreign government, though the investigation is ongoing.
German security researcher Ralf-Philipp Weinmann suggested the hack took advantage of weaknesses in the password encryption algorithm “Dual_EC” that were reportedly engineered by the NSA, which then promoted the tool as a standard.
“Juniper discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker to gain administrative access to NetScreen devices and to decrypt VPN connections,” said Bob Worrall, SVP and chief information officer at Juniper Networks.
“Once we identified these vulnerabilities, we launched an investigation into the matter, and worked to develop and issue patched releases for the latest versions of ScreenOS. At this time, we have not received any reports of these vulnerabilities being exploited; however, we strongly recommend that customers update their systems and apply the patched releases with the highest priority.”
It is unknown how Juniper’s source code was altered, and whether it was the work of an external source or someone within the company.
Juniper, based in Sunnyvale, California, issued an advisory notice on 21 December, notifying users of ScreenOS 6.3.0r17 through 6.3.0r20 which is part of the software for its firewall and VPN devices. No other versions of the product are known to be affected.
Those who were affected will potentially see an entry in the log file suggesting that “system” had logged in, followed by a password authentication, though a skilled hacker would probably be able to remove all traces of a login. Given the sophisticated nature of the hack, and how long it was able to remain undetected, Juniper notes that there is “no way to detect that this vulnerability was exploited”.
Juniper’s clients include the US government, including the Defense Department, Justice Department, and Treasury Department – as well as the FBI.