Juniper Networks Finds Backdoor in Firewall Source Code

 Those in charge of network security at their organization or at home, and using Juniper Networks ScreenOS should apply the latest out-of-cycle patch right away. The company alerted customers that unauthorized code was placed in the source code of the ScreenOS product about three years ago “that could allow a knowledgeable attacker to gain administrative access to NetScreen® devices and to decrypt VPN connections.”

The patch was released earlier this week shortly after the issue was discovered. Affected devices include ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20. Because of the potential seriousness of the damage that could be done, anyone using the devices should apply the patch right away, even if it isn’t within the normal patch cycle for the organization.

It is unknown how the unauthorized code made its way into the source code; whether by an internal source or the outside and it may never be determined. However, these products are widely used in corporate America and also within the U.S. Government. Major organizations such as the Department of Defense, the White House, the State Department, and the Office of Personnel Management (OPM) which experienced a major data breach earlier this year resulting in very personal details of over 21.5 million people being stolen all use them.

The vulnerability creates a “backdoor” in the software. It is essentially a secret hole left open for anyone to use if they find it. Anyone with the knowledge and desire to exploit it could use this to spy on an organization; even if the data passing through the network is encrypted. It’s that tiny, nearly undetectable hole in the screen door and the bad guy is the “fly on the wall” that got through it.

In addition to applying this one, and any patch deemed urgent, organizations should have a patch schedule and policy in place. It should include some regular timeframe, such as each week or each month, when non-critical updates are completed, as well as a strategy for applying the out-of-cycle ones that are released now and then. Then, make sure it is reviewed and followed.

Often times, companies will create security policies and strategies, but never review or revise them. Then, when they are needed the information is outdated or irrelevant. So take some time to update them at least annually and when an involved employee leaves the company.

Juniper Networks has no evidence at this time that the open door the rogue code created was used for any nefarious reasons. However, because the products it affects are a first line of defense for many organizations including many government organizations, the FBI is also involved. While no conclusions have been made, officials suspect it is the work of a foreign government. Now, that the hole in the screen has been found and Juniper has sealed it, it’s the FBIs job to catch and swat the fly.

Some reports are stating there may be two backdoors. However, whether or not it is indeed the case and if they are related is still to be determined. This story is likely to continue for some time.