FBI accused of planting backdoor in OpenBSD IPSEC stack

mir

Long time no talk. If you will recall, a while back I was the CTO at
NETSEC and arranged funding and donations for the OpenBSD Crypto
Framework. At that same time I also did some consulting for the FBI,
for their GSA Technical Support Center, which was a cryptologic
reverse engineering project aimed at backdooring and implementing key
escrow mechanisms for smart card and other hardware-based computing
technologies.

My NDA with the FBI has recently expired, and I wanted to make you
aware of the fact that the FBI implemented a number of backdoors and
side channel key leaking mechanisms into the OCF, for the express
purpose of monitoring the site to site VPN encryption system
implemented by EOUSA, the parent organization to the FBI. Jason
Wright and several other developers were responsible for those
backdoors, and you would be well advised to review any and all code
commits by Wright as well as the other developers he worked with
originating from NETSEC.

http://permalink.gmane.org/gmane.os.openbsd.tech/22557

http://arstechnica.com/open-source/news/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack.ars

oh boy !

hussam

I read this yesterday. I was pretty shocked.

saeidw

Well, two things instantly come to mind.

1. Since the IPSEC source code is BSD licensed, we can actually audit it and find out if these allegations are true. So that's a good thing.

2. Since the IPSEC source code is BSD licensed, and the BSD license allows you to use the code in products that can be released under another license, there are potentially many products using this stack which suffer from these backdoors (assuming the allegations are true, we don't know yet!), and we might never know which ones. The users are at the mercy of the manufacturers of these products who might decide not to fix the issue, or may not even be aware of it.

A lot of open source supporters (including myself) like to say that open source software is inherently more secure because there are many eyes examining the source code. Now if the allegations are true, then we've got one big counter-example showing a case where the "many eyes" rule has failed us.

This impacts open source as a development model, it means that we can't just rely on the nature of the source code, we must also intentionally implement security checks and balances to ensure that the contributions to a project are not malicious.

It doesn't impact open source as a philosophy: because the software gives us the freedom to examine and modify the source code, we have the power to remedy the situation, we can fix these backdoors!

Personally, I'm hoping that the allegations turn out to be true, and that an audit of the source code shows that the backdoors were fixed as development of the stack continued. This way, I can still feel comfortable about the "many eyes" nature of open source software.

rolf

If these went undetected for 10 years, then they must be pretty well buried.

BashLogic

they are, ever since NSA began setting the initial specification of selinux used by RedHat and other distros :)

EddieEC

That reminds of a book I finished reading called Digital Fortress where the NSA tried planting a backdoor in an encryption method called SkipJack, and they were going to release it to the public but some guy caught them. Good, good book.

Joe

The accused developer's response.

I really doubt there's a back door in OpenBSD. Just like saeidw mentioned, the code goes through heavy auditing before going in the repos. Especially with OpenBSD. But more importantly I really doubt that no sysadmin has ever realized the presence of a back door (allegedly planted a decade ago) in an operating system regarded as one of the most secure.

The debate about malicious code filtering in open source projects is interesting but should be started on a dedicated thread in my opinion. As for this news I say rumor. What do you guys think?

shekvaL

well i agree with Rahmu , its a rumor.