Pentagon warns contractors of Juniper vulnerabilities

The Pentagon has spelled out for defense contractors the ways in which they are susceptible to a backdoor in Juniper Networks products – vulnerabilities that reportedly have federal investigators worried about foreign espionage.

In a Dec. 22 notice to industry obtained by FCW, the Defense Security Service, the agency in charge of interfacing with cleared contractors, warns that one of the recently disclosed vulnerabilities in the networking giant's products could allow remote administrative access to a device over secure shell or telnet protocols, "which could result in a complete compromise of the affected system."

Juniper, whose firewalls are used extensively in both the public and private sectors, announced last month that it had discovered unauthorized code in its operating software that could allow a "knowledgeable attacker" to pierce its firewall and decrypt virtual private network connections.

The Department of Defense is among Juniper Networks' big federal customers; dozens of Juniper products are on the Defense Information Systems Agency's Unified Capabilities Approved Product List.

According to Juniper, the decryption of VPN connections can happen "without any means to detect if the vulnerability was exploited," the DSS "cyber alert" states.

The DSS notice passes on advice from an intelligence report that strongly "advises users to patch vulnerable versions as soon as possible beginning with Internet-facing firewalls." The publication Motherboard was first to report on the unclassified memo.

Juniper's disclosure set off a storm of speculation about who could be exploiting the backdoor. Federal investigators are concerned that foreign spies used the backdoor to access the encrypted communications of the U.S. government and private firms for the last three years, according to a CNN report.

Brendan Conlon, who worked computer network operations at the National Security Agency for a decade, described the Juniper backdoor as "quite an impressive operation" and probably the handiwork of a foreign intelligence organization.

"I'm sure there are some in the [U.S. government] that have a healthy respect for its execution" Conlon, who is now CEO of network security firm Vahna, told FCW in an email. "Break into one of the largest provider of firewalls in the world and insert a backdoor into their core intellectual property? While costly, it is impressive."

Other theories of the development of the vulnerability have been propounded. Johns Hopkins University computer scientist and cryptography expert Matthew Green suggests that the Juniper flaw potentially constitutes blowback from the deliberate weakening of a widely used cryptographic standard by the NSA. Green noted on his blog that the affected Juniper hardware utilized a random number generator that was potentially compromised by the NSA.

"To sum up, some hacker or group of hackers noticed an existing backdoor in the Juniper software, which may have been intentional or unintentional…then piggybacked on top of it to build a backdoor of their own," Green wrote.

No confirmed exploitations of the vulnerabilities have been reported yet, according to the DSS memo, which provides two security signatures to detect unauthorized access to Juniper products.

The Department of Homeland Security hub for sharing cyber intelligence "is aware of the report regarding Juniper's software," DHS spokesman S.Y. Lee said in a recent statement. "As we routinely do when such vulnerabilities are brought to light, we are assessing the potential impact, if any, on federal networks, and will take any appropriate mitigation measures in close coordination with interagency partners."

A Juniper spokesperson said the firm had no update on the investigation.

The DSS memo concludes by citing advice from the intelligence community that "highly recommends" contractors install the latest version of Juniper's operating systems "due to the severity of these vulnerabilities."