Menu
Juniper warns of spying code in firewalls

Juniper warns of spying code in firewalls

The NSA has targeted Juniper firewalls in the past

Juniper, a major manufacturer of networking equipment, said on Thursday it found spying code planted in certain models of its firewalls, an alarming discovery that echoes of state-sponsored tampering.

The affected products are those running ScreenOS, one of Juniper's operating systems that runs on a range of appliances that act as firewalls and enable VPNs. ScreenOS versions 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 are vulnerable, according to an advisory.

The unauthorized code was found during a recent internal review, wrote Bob Worrall, Juniper's chief information officer. He did not indicate where Juniper thinks the code originated.

Juniper has released critical patches to fix the problems.

"At this time, we have not received any reports of these vulnerabilities being exploited; however, we strongly recommend that customers update their systems and apply the patched releases with the highest priority," Worrell wrote.

The internal review uncovered two problems. One could allow remote administrative access to a ScreenOS device over telnet or SSH.

Although log files would reflect a login attempt, "a skilled attacker would likely remove these entries from the log file, thus effectively eliminating any reliable signature that the device had been compromised," Juniper wrote.

The second vulnerability can allow an attacker who can monitor VPN traffic to decrypt it. VPNs are encrypted connections between a user and another computer and are often used by companies to allow secure remote access to their systems for employees who are traveling.

Disturbingly, Juniper wrote that "there is no way to detect that this vulnerability was exploited."

The earliest affected version of ScreenOS, 6.2.0r15, appears to have been released in September 2012, according to documentation.

That suggests attackers may have had access to corporate firewalls and VPN connections for a long time if Juniper was compromised at that time. Firewalls are rich targets for cyberattackers since the devices monitor all data traffic flowing in and out of an organization.

The compromise of such a prominent vendor with code specifically designed for spying echoes operations by the NSA described in documents leaked in 2013 by former contractor Edward Snowden.

A December 2013 story in the German publication Der Spiegel described a 50-page catalog of hardware and software tools used by the NSA to infiltrate the equipment, including one targeted at Juniper's NetScreen appliances.

The document describes a technique nicknamed FEEDTROUGH, which is used to keep two kinds of software implants on a Juniper NetScreen firewall.  The technique is aimed at keeping the software implants on the device even if it reboots or is upgraded.

The NSA also targeted other major networking manufacturers, including Cisco and Huawei, Der Spiegel reported. 

 


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments