Subject: [saag] new preprint on Juniper vuln...

From: Joseph Lorenzo Hall <[email-masked]>
Date: Thu, 14 Apr 2016 14:32:36 -0400

Some of you may be interested in this preprint:

http://dualec.org/DualECJuniper-draft.pdf

A Systematic Analysis of the Juniper Dual EC Incident

Stephen Checkoway, Shaanan Cohney, Christina Garman, Matthew Green,
Nadia Heninger, Jacob Maskiewicz, Eric Rescorla, Hovav Shacham,
Ralf-Philipp Weinmann,

Abstract

In December 2015, Juniper Networks announced that
unknown attackers had added unauthorized code to
ScreenOS, the operating system for their NetScreen VPN
routers. This code created two vulnerabilities: an authen-
tication bypass that enabled remote administrative access,
and a second vulnerability that allowed passive decryption
of VPN traffic. Reverse engineering of ScreenOS binaries
revealed that the first of these vulnerabilities was a con-
ventional back door in the SSH password checker. The
second is far more intriguing: a change to the Q parameter
used by the Dual EC pseudorandom number generator. It
is widely known [7, 33] that Dual EC has the unfortunate
property that an attacker with the ability to choose Q can,
from a small sample of the generator’s output, predict all
future outputs. In a 2013 public statement, Juniper noted
the use of Dual EC but claimed that ScreenOS included
countermeasures that neutralized this form of attack.

In this work, we report the results of a thorough inde-
pendent analysis of the ScreenOS randomness subsystem,
as well as its interaction with the IKE VPN key estab-
lishment protocol. Due to apparent flaws in the code,
Juniper’s countermeasures against a Dual EC attack are
never executed. Moreover, by comparing sequential ver-
sions of ScreenOS, we identify a cluster of additional
changes that were introduced concurrently with the in-
clusion of Dual EC in a single 2008 release. Taken as a
whole, these changes render the ScreenOS system vul-
nerable to passive exploitation by an attacker who selects
Q. We demonstrate this by installing our own parame-
ters, and showing that it is possible to passively decrypt
a single IKE handshake and its associated VPN traffic in
isolation without observing any other network traffic.

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871