Cybersecurity

Pentagon warns contractors of Juniper vulnerabilities

Shutterstock image: breached lock.

The Pentagon has spelled out for defense contractors the ways in which they are susceptible to a backdoor in Juniper Networks products – vulnerabilities that reportedly have federal investigators worried about foreign espionage.

In a Dec. 22 notice to industry obtained by FCW, the Defense Security Service, the agency in charge of interfacing with cleared contractors, warns that one of the recently disclosed vulnerabilities in the networking giant's products could allow remote administrative access to a device over secure shell or telnet protocols, "which could result in a complete compromise of the affected system."

Juniper, whose firewalls are used extensively in both the public and private sectors, announced last month that it had discovered unauthorized code in its operating software that could allow a "knowledgeable attacker" to pierce its firewall and decrypt virtual private network connections.

The Department of Defense is among Juniper Networks' big federal customers; dozens of Juniper products are on the Defense Information Systems Agency's Unified Capabilities Approved Product List.

According to Juniper, the decryption of VPN connections can happen "without any means to detect if the vulnerability was exploited," the DSS "cyber alert" states.

The DSS notice passes on advice from an intelligence report that strongly "advises users to patch vulnerable versions as soon as possible beginning with Internet-facing firewalls." The publication Motherboard was first to report on the unclassified memo.

Juniper's disclosure set off a storm of speculation about who could be exploiting the backdoor. Federal investigators are concerned that foreign spies used the backdoor to access the encrypted communications of the U.S. government and private firms for the last three years, according to a CNN report.

Brendan Conlon, who worked computer network operations at the National Security Agency for a decade, described the Juniper backdoor as "quite an impressive operation" and probably the handiwork of a foreign intelligence organization.

"I'm sure there are some in the [U.S. government] that have a healthy respect for its execution" Conlon, who is now CEO of network security firm Vahna, told FCW in an email. "Break into one of the largest provider of firewalls in the world and insert a backdoor into their core intellectual property? While costly, it is impressive."

Other theories of the development of the vulnerability have been propounded. Johns Hopkins University computer scientist and cryptography expert Matthew Green suggests that the Juniper flaw potentially constitutes blowback from the deliberate weakening of a widely used cryptographic standard by the NSA. Green noted on his blog that the affected Juniper hardware utilized a random number generator that was potentially compromised by the NSA.

"To sum up, some hacker or group of hackers noticed an existing backdoor in the Juniper software, which may have been intentional or unintentional…then piggybacked on top of it to build a backdoor of their own," Green wrote.

No confirmed exploitations of the vulnerabilities have been reported yet, according to the DSS memo, which provides two security signatures to detect unauthorized access to Juniper products.

The Department of Homeland Security hub for sharing cyber intelligence "is aware of the report regarding Juniper's software," DHS spokesman S.Y. Lee said in a recent statement. "As we routinely do when such vulnerabilities are brought to light, we are assessing the potential impact, if any, on federal networks, and will take any appropriate mitigation measures in close coordination with interagency partners."

A Juniper spokesperson said the firm had no update on the investigation.

The DSS memo concludes by citing advice from the intelligence community that "highly recommends" contractors install the latest version of Juniper's operating systems "due to the severity of these vulnerabilities."

About the Author

Sean Lyngaas is an FCW staff writer covering defense, cybersecurity and intelligence issues. Prior to joining FCW, he was a reporter and editor at Smart Grid Today, where he covered everything from cyber vulnerabilities in the U.S. electric grid to the national energy policies of Britain and Mexico. His reporting on a range of global issues has appeared in publications such as The Atlantic, The Economist, The Washington Diplomat and The Washington Post.

Lyngaas is an active member of the National Press Club, where he served as chairman of the Young Members Committee. He earned his M.A. in international affairs from The Fletcher School of Law and Diplomacy at Tufts University, and his B.A. in public policy from Duke University.

Click here for previous articles by Lyngaas, or connect with him on Twitter: @snlyngaas.


Featured

  • Cybersecurity
    Shutterstock photo id 669226093 By Gorodenkoff

    The disinformation game

    The federal government is poised to bring new tools and strategies to bear in the fight against foreign-backed online disinformation campaigns, but how and when they choose to act could have ramifications on the U.S. political ecosystem.

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.