You won&#x27;t find that many pen testers making 600K a year, I don&#x27;t think you find a single one that&#x27;s paid that much for actual technical delivery.
Pen-testers are also not the people that should be doing code reviews necessarily as they most likely lack experience in that regard.<p>Money doesn&#x27;t solve everything, you can bring out 200 people and they&#x27;ll still won&#x27;t find everything and being able to figure out how everything works.<p>The hardcoded password backdoor was well obfuscated but at least something still &quot;easily&quot; detectable the Dual-EC vuln where some one replaced the values with their own pre-computed pair I don&#x27;t even want to know how they found that out other than by chance.<p>And when you&#x27;ll start going deeper It&#x27;s just gets more complicated It won&#x27;t be easy to find a 100 people that will be able to do code review on say the kernel of ScreenOS world wide, heck considering the specific skill set that they&#x27;ll need to have: being able to understand the source code, assembly, being able to figure out how if it can be leveraged in any way which will affect the security of product on a software or hardware level (we are dealing with mother of all registers here after all) and being available for hire that&#x27;s not something that trivial.<p>And lastly this might not be solvable with money at all identifying backdoors in unknown code is very difficult the technology that can do so is very limited and the manual approach is prone to human errors and oversight. Even if you get a team of a 100 leading code review, malware and security experts in the world I would not bet money that they&#x27;ll be able to scrub anything within a year.
And I would not even attempt to hire a 100 of them, the time it will take to bring them up to speed would be pretty exhaustive, a safer bet would be to have your own developers which worked on the products from year to go over small parts of the code and flag something unusual.<p>If Juniper is smart they&#x27;ll crowd source that internally and have various code snippets pop up on the screens of randomly selected developers and have them being evaluated, when a snippet gets enough flags forward it to an expert and have them review it.
But that again only works if a) the backdoor is localized and not staged across various steps in the logic flaw it self, and b) the backdoor is in the actual source code and not only present in the binaries because the tool chain itself was compromised.<p>Life isn&#x27;t simple.