Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:30 PM
Connect Directly

Yellow Alert Sounded For Juniper Vulns, Feds Called In

SANS ISC raises infosec alert level and FBI investigates potential nation-state activity leading to backdoor vulnerabilities in Juniper ScreenOS products.

The infosec alert level for the Internet Storm Center was bumped to yellow today on the heels of the announcement of two crucial vulnerabilities Juniper firewalls that rocked the infosec world last week. And as the industry scrambles to fill these gaping holes in its ScreenOS platform, news continues to trickle in that FBI officials are investigating potential nation-state actions that led to the insertion of an authentication backdoor that impacts tens of thousands of devices on the Internet.

Johannes Ullrich, director of the SANS ISC, said in a post this morning that the ISC decided to raise the alert level for three big reasons.

"Juniper devices are popular, and many organizations depend on them to defend their networks. The "backdoor" password is now known, and exploitation is trivial at this point," Ullrich wrote.  "With this week being a short week for many of us, addressing this issue today is critical."

As he warns security practitioners, there is very little that organizations can do to protect themselves from these vulnerabilities, particularly the one which allows attackers to decrypt VPN traffic. The backdoor vulnerability which requires that password to be activated--a point moot now that it is publicly known--but it can be countered by restricting access to SSH and telnet.

"Only administrative workstations should be able to connect to these systems via ssh, and nobody should be able to connect via telnet," he says. "This is "best practice" even without a backdoor."

Researchers with FoxIT initially reported finding the backdoor password within six hours of getting their hands on the Juniper patch. According to a post from HD Moore, chief research officer at Rapid7, the password  was chosen to look like other debug format strings in the code.

As he explains, the timing is interesting on these vulnerabilities as they were not present within versions of the software before 2013 releases.

"The authentication backdoor is not actually present in older versions of ScreenOS," Moore wrote. "The authentication backdoor did not seem to get added until a release in late 2013."

This could be another breadcrumb on the trail of investigators looking into how such a huge hole--one affecting over 26,000 devices according to a scan made by Moore--could have been inserted into the source code of such a prominent security product. According to a CNN report, the FBI is currently investigating the possibility that nation-state actors placed the backdoor for the purpose of espionage. Meanwhile, The Register reports an anonymous former Juniper employee who pointed to the fact that much of Juniper's "sustaining engineering" for ScreenOS is done in China.


Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.