In an attempt to find out more about its role in the loophole found in Juniper Networks products back in 2015, many U.S. senators sent a letter to the National Security Agency last week, as well as the measures taken by the agency after the Juniper attack, and why those steps failed to deter the latest hacking of SolarWinds.
In late 2015, Juniper Networks told consumers that in certain versions of its ScreenOS operating system, which operated the company’s firewalls, it had found unauthorised code. A vulnerability that could be abused to obtain remote access to a computer and a vulnerability that could have been leveraged to decrypt VPN traffic were added by the code.
The VPN problem was related to the use of a NIST-approved cryptographic algorithm, the Dual Elliptic Curve Deterministic Random Bit Generator (Dual EC DRBG), which was considered to include a loophole implemented by the NSA. In order to avoid abuse, Juniper had made some improvements, but the malicious code allowed the backdoor. Some suggested that the illegal code was the fault of the security department, but Juniper claimed it was actually attacked by a foreign government.
The Juniper backdoor was also distributed to several government and private organisations in the United States, either through software patches or new products, similar to the recent SolarWinds hack, in which attackers, suspected to be sponsored by Russia, provided malicious updates to many of the company’s clients.
A couple of months ago, a delegation of three senators and thirteen representatives of the United States A letter to Juniper was sent by the House of Representatives telling the firm about the outcome of its inquiry into the incident. At the behest of a customer, Juniper said it added support for Dual EC DRBG, but didn’t specify who the customer was or whether the customer was a U.S. government entity. None of the persons involved in the decision to use the controversial cryptographic algorithm are currently working there, the organisation said.
In an attempt to learn more about the agency’s position in the Juniper incident, Senators and House members have now sent a letter to the NSA.
The lawmakers noted in their letter that the loophole of the Juniper could have allowed a foreign nation or a different foe to break into the correspondence of several corporations and government agencies. They asked the NSA to explain the steps it took to secure government agencies after the revelation of the Juniper incident, and why such interventions have not stopped the latest supply chain assault by SolarWinds.
The NSA has also been advised to provide more details about its development and use of the algorithm, and say if it was the customer who requested Juniper to include support for it in its goods.
Legislators are still interested in figuring out if the NSA felt it might be legal to incorporate a backdoor into a U.S. government-approved algorithm, and who would require permission if it tried to introduce backdoors or other vulnerabilities into government norms.
The NSA was provided until 26 February in order to include unclassified responses.
