A Systematic Analysis of the Juniper Dual EC Incident

Abstract

In December 2015, Juniper Networks announced multiple security vulnerabilities stemming from unauthorized code in ScreenOS, the operating system for their NetScreen VPN routers. The more sophisticated of these vulnerabilities was a passive VPN decryption capability, enabled by a change to one of the elliptic curve points used by the Dual EC pseudorandom number generator.In this paper, we describe the results of a full independent analysis of the ScreenOS randomness and VPN key establishment protocol subsystems, which we carried out in response to this incident. While Dual EC is known to be insecure against an attacker who can choose the elliptic curve parameters, Juniper had claimed in 2013 that ScreenOS included countermeasures against this type of attack. We find that, contrary to Juniper's public statements, the ScreenOS VPN implementation has been vulnerable since 2008 to passive exploitation by an attacker who selects the Dual EC curve point. This vulnerability arises due to apparent flaws in Juniper's countermeasures as well as a cluster of changes that were all introduced concurrently with the inclusion of Dual EC in a single 2008 release. We demonstrate the vulnerability on a real NetScreen device by modifying the firmware to install our own parameters, and we show that it is possible to passively decrypt an individual VPN session in isolation without observing any other network traffic. We investigate the possibility of passively fingerprinting ScreenOS implementations in the wild. This incident is an important example of how guidelines for random number generation, engineering, and validation can fail in practice.

Poison in the Well: Securing the Shared Resources of Machine Learning

“…Attackers changed the process for generating one of the random numbers in the encryption code, allowing them to decrypt sensitive traffic. 5 All of Juniper's customers were vulnerable.…”

Taking Control of SDN-based Cloud Systems via the Data Plane

“…For example, Matsumoto et al [50] focus on insider threats. Furthermore, national security agencies are reported to have bugged networking equipment [5] and networking vendors have left backdoors open [3,4,15], leading to additional threats.…”

Measuring the Security Harm of TLS Crypto Shortcuts

“…They also attacked engineers at Belgacom, the largest ISP in Belgium, in order to gain access to traffic from its core routers [21]. An unknown adversary -thought to be a nation state -infiltrated Juniper Networks' code repository and inserted a cryptographic backdoor into the company's VPN products [9]. Similar operations could be used to access STEKs from high-value targets.…”