Menu
U.S. Congress to federal agencies: You have two weeks to tally your backdoored Juniper kit

U.S. Congress to federal agencies: You have two weeks to tally your backdoored Juniper kit

The House of Representatives wants to gauge the impact of the recent Juniper ScreenOS backdoors on government departments and agencies

Around two dozen U.S. government departments and federal agencies are being questioned by the U.S. Congress on whether they were using backdoored Juniper network security appliances.

In December, Juniper Networks announced that it had discovered unauthorized code added to ScreenOS, the operating system that runs on its NetScreen network firewalls. The rogue code, which remained undetected for 2 years or more, could have allowed remote attackers to gain administrative access to the vulnerable devices or to decrypt VPN connections.

The U.S. House of Representatives' Committee on Oversight and Government Reform wants to determine the impact that this issue had on government organizations and how the affected organizations responded to the incident.

The Committee sent letters on Jan. 21 to the Department of Defense, the Health Department, the State Department, the Securities and Exchange Commission (SEC), the Nuclear Regulatory Commission, NASA, the Social Security Administration, USAID and many other government agencies.

The letters ask the recipients to identify whether they used devices running the affected ScreenOS versions, to explain how they learned about the issues and whether they took any corrective actions before Juniper released patches and to specify when they applied the company's patches.

The questioned organizations have only two weeks, until Feb. 4, to respond and deliver the appropriate documents, a very tight time frame giving that "the time period covered by this request is from January 1, 2009 to the present."

Determining whether any division of a government department or agency used a vulnerable Juniper appliance for any period of time might prove difficult, especially if accurate inventories haven't been kept. For example, last year, due to inaccurate inventory records, the Internal Revenue Service did not know whether 1,300 of its computers had been upgraded away from Windows XP, which was retired by Microsoft in April 2014.

Security researchers estimate that the VPN backdoor was introduced into ScreenOS in August 2012 and the administrative access one in late 2013. Juniper has yet to reveal who and how added the unauthorized code to ScreenOS and the incident is reportedly being investigated by the FBI.

It will also be interesting to see if the Committee on Oversight and Government Reform is only interested in this particular case, or will make similar inquiries going forward. After all, intentional or unintentional backdoor-like vulnerabilities -- such as hidden administrative accounts with hard-coded, static passwords -- are frequently found in networking products from a variety of vendors, and some of them are likely used by government agencies.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments