Juniper VPN-code falls victim to cyber espionage

Late last week, Juniper Networks announced that an internal review had uncovered 'unauthorised' code that had been inserted into key ScreenOS VPN-communication software, which enabled the miscreant to monitor the content of VPN traffic. The company has discovered two distinct corruptions of its code: the first allowed "unauthorized remote administrative access" which could lead to the complete compromise of a targeted system, while the second enabled VPN traffic to be decrypted and monitored. Juniper believes that the two sets of code are unrelated, however their conjunction would mean that a party with knowledge of both of the illicit back-doors would essentially have full and open access to a target's VPN traffic. It is likely that the rogue code was added in late 2013, and experts emphasise that detection is impossible, as the attackers would have had full access rights and hence the ability to erase all tracks. The FBI is investigating what appears to be a clear case of cyber-espionage, and the key question has to be how many other internet security products have undiscovered rogue code lurking within them?

Rapid7's Chief Research Officer, HD Moore, has posted some notes on the Juniper ScreenOS incident. After analyzing the patches released by Juniper, Moore's team discovered the backdoor password that enables the Telnet and SSH bypass.

In a blog post on Rapid7's community portal, Moore said that a quick Shodan search identified 26,000 public-facing Netscreen devices with SSH open. Considering the severity of the issues disclosed by Juniper on December 18, his team started digging.

Last week, Juniper said that an internal audit uncovered unauthorized code that was added to ScreenOS. The added code created two security issues. The first is an authentication bypass, and the second issue would allow an attacker to monitor and decrypt VPN traffic.

To address the problems created by the added code, Juniper released new versions of their ScreenOS, but older versions of the firmware were rebuilt with the backdoor removed. Moore's team analyzed the rebuilt updates and discovered backdoor password. As part of their analysis efforts, the decompressed binaries have been made available on GitHub.

As for the backdoor password itself, it was clearly visible in a "strcmp" call in the old firmware:

<<< %s(un='%s') = %u

"This password allows an attacker to bypass authentication through SSH and Telnet, as long as they know a valid username. If you want to test this issue by hand, telnet or SSH to a Netscreen device, specify a valid username, and the backdoor password. If the device is vulnerable, you should receive an interactive shell with the highest privileges," Moore wrote.

The post also made an interesting observation. While Juniper claimed versions 6.2.0r15 to 6.2.0r18 and 6.3.0r12 to 6.3.0r20 were affected by the backdoor issue, the authentication bypass isn't present in older versions of ScreenOS.

"We were unable to identify this backdoor in versions 6.2.0r15, 6.2.0r16, 6.2.0r18 and it is probably safe to say that the entire 6.2.0 series was not affected by this issue (although the VPN issue was present). We were also unable to identify the authentication backdoor in versions 6.3.0r12 or 6.3.0r14," Moore explained.

Moore's team were also able to confirm that versions 6.3.0r17 and 6.3.0r19 were affected. It's interesting, Moore said, because while the first affected version of ScreenOS was released in 2012, the authentication backdoor didn't seem to get added until a release in late 2013.

Detecting an attack against the authentication bypass is said to be hopeless, because an attacker could easily delete the logs. However, any logs sent to a central logging server or SIEM would be captured and can be used to trigger alerts.

Fox-IT created Snort rules to detect access with the backdoor password.

Rapid7 is the second company to detect the backdoor password, Fox-IT found it first, but didn't disclose it publicly. If these two firms were able to find it with ease, it's highly likely that criminals have as well.

This will be a busy week for IT teams across the globe, because Juniper is everywhere.

It still isn't clear where the rogue code in ScreenOS came from, but that is a question to answer later. For now, the most important task is patch management and getting the updates pushed to vulnerable devices.