Researchers contradict Juniper claim that Dual_EC_DRBG weakness couldn’t be exploited.
Juniper Networks, which last month made the startling announcement its NetScreen line of firewalls contained unauthorized code that can surreptitiously decrypt traffic sent through virtual private networks, said it will remove a National Security Agency-developed function widely suspected of also containing a backdoor for eavesdropping.
The networking company said in a blog post published Friday that it will ship product releases in the next six months that remove the Dual_EC_DRBG random number generator from NetScreen firewalls. Security researchers have known since 2007 that it contains a weakness that gives knowledgeable adversaries the ability to decrypt encrypted communications that rely on the function. Documents provided by former NSA subcontractor Edward Snowden showed the weakness could be exploited by the US spy agency, The New York Times reported in 2013.
A month after the NYT report was published, Juniper officials wrote in a knowledge base article that NetScreen encryption couldn’t be subverted by the weakness because Dual_EC_DRBG wasn’t the sole source for generating the random numbers needed to ensure strong cryptography. The Juniper post said NetScreen also relied on a separate random number generator known as ANSI X.9.31 that made it infeasible to exploit the Dual_EC_DRBG weaknesses. Random number generators are a crucial ingredient in strong cryptography. Their role is similar to the shaking of dice at a craps table and ensure that keys contain enough entropy to make them infeasible to guess or predict.
Troubling new revelations
Research presented this week at the Real World Cryptography Conference 2016, however, contradicted the Juniper claim. In essence, the researchers said, NetScreen used predictable outputs from Dual_EC_DRBG to bypass ANSI X.9.31. The researchers went on to document a separate code change made in 2008 that increased the size of the cryptographic nonce used to generate random numbers. By lengthening it from 20 bytes to 32 bytes, the new code ensured attackers had enough raw output to exploit the Dual_EC_DRBG weaknesses. Had the older 20-nonce code remained, exploits would have been orders of magnitude more difficult.
The researchers went on to document two additional code changes that also allowed adversaries to break the encryption provided by NetScreen firewalls. The first was made in 2012. It changed a mathematical constant that the researchers believed allowed its creator to eavesdrop. The second was made in 2014 and made it possible for anyone who knew a hard-coded password to decrypt communications. Researchers have yet to disclose evidence implicating a specific person or group responsible for the changes, but the tie to Dual_EC_DRBG is prompting many investigators to suspect the NSA is involved.
Slides from the presentation are here. Credit for discovery of the password backdoor goes to Rapid7 Chief Research Officer HD Moore. Credit for many of the findings related to Dual_EC_DRBG goes to Ralf Philipp Weinmann and Willem Pinckaers. Wired has many more details about the recent findingshere.
When Juniper disclosed the backdoor last month, it released an update that reverted the constant back to what was used prior to the 2012 update. The changes Juniper announced Friday go further. They remove both Dual_EC_DRBG and ANSI X.9.32 functions. Juniper developers will replace them with the same random number generators currently used across the company’s portfolio of Junos OS products.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
