Article 43

 

Wednesday, December 15, 2010

FBI Accused Of Hacking OpenBSD

Lydia Leavitt
TG Daily
December 15, 2010

Finally breaking his ten year NDA enforced silence, former NETSEC CTO Gregory Perry has revealed that devs (allegedly) helped the FBI plant “a number of backdoors” in the OpenBSD cryptographic framework.

Perry confirmed the backdoor hacks in an e-mail to Theo de Raadt, OpenBSD project leader in the 90s.

The email said, “I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI.”

Perry goes on to talk about the year 2003 when OpenBSD lost millions of dollars of grant funding from the US Defense Advanced Research Projects Agency (DARPA) that develops new military technology.

“This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn’t want to create any derivative products based upon the same.”

Immediately after receiving the e-mail, Theo de Raadt forwarded its contents to everyone on the OpenBSD mailing list asking for code audits to ensure security.

In a statement De Raadt said, “It is alleged that some ex-developers (and the company they worked for) accepted US government money to put backdoors into our network stack.

He continued, “Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products. Over 10 years, the IPSEC code has gone through many changes and fixes, so it is unclear what the true impact of these allegations are.”

It’s true, technologists wonder if this email is legit or just plain rubbish. Perry claims to have been the CTO for NETSEC ten years ago. NETSEC was apparently the professional services firm dealing with security architecture and engineering as well as a 24/7 computer emergency response team for the Executive Office of the United States Attorneys.

Strangely, attempts to contact the site have failed and there is no official proof that Perry was indeed the companys CTO.

TechNewsWorld contacted Chris Wysopal, cofounder and CTO of Veracode to get an idea of whether or not a government organization would actually put some backdoor code into open source code.

“There’s a few things that don’t make sense,” Wysopal said. “One is that, if the government had a contract with an organization to put in a backdoor, that would be a government secret that wouldn’t expire after a certain amount of time. So I can’t see how an NDA about this would expire.”

But Wysopal admits it would be difficult to detect backdoors if they exist.

“You need to do an in-depth analysis line by line of the code and look for different side effects that the code might have,” Wysopal explained. “If you’re not a crypto expert, I don’t think you’d find the backdoor by just eyeballing the code,” he added.

Rumors do exist that the government has put backdoor code into encrypted algorithms in the past, which does add some validity to PerryҒs claims.

Regardless of whether its true or not, de Raadt hopes the community will find any problems in the code, but plans to take no further legal action on the matter.

SOURCE

---

List:  openbsd-tech
Subject:  Allegations regarding OpenBSD IPSEC
From:  Theo de Raadt <deraadt () cvs ! openbsd ! org>
Date:  2010-12-14 22:24:39
Message-ID: 201012142224.oBEMOdWM031222 () cvs ! openbsd ! org

I have received a mail regarding the early development of the OpenBSD IPSEC stack.  It is alleged that some ex-developers (and the company they worked for) accepted US government money to put backdoors into our network stack, in particular the IPSEC stack.  Around 2000-2001.

Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products.  Over 10 years, the IPSEC code has gone through many changes and fixes, so it is unclear what the true impact of these allegations are.

The mail came in privately from a person I have not talked to for nearly 10 years.  I refuse to become part of such a conspiracy, and will not be talking to Gregory Perry about this.  Therefore I am making it public so that

(a) those who use the code can audit it for these problems,
(b) those that are angry at the story can take other actions,
(c) if it is not true, those who are being accused can defend themselves.

Of course I don’t like it when my private mail is forwarded.  However the “little ethic” of a private mail being forwarded is much smaller than the “big ethic” of government paying companies to pay open source developers (a member of a community-of-friends) to insert privacy-invading holes in software.

----

From: Gregory Perry <Gregory.Perry@GoVirtual.tv>
To: “deraadt@openbsd.org” <deraadt@openbsd.org>
Subject: OpenBSD Crypto Framework
Thread-Topic: OpenBSD Crypto Framework
Thread-Index: AcuZjuF6cT4gcSmqQv+Fo3/+2m80eg==
Date: Sat, 11 Dec 2010 23:55:25 +0000
Message-ID: <8D3222F9EB68474DA381831A120B1023019AC034@mbx021-e2-nj-5.exch021.domain.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status: RO

Hello Theo,

Long time no talk.  If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework.  At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing technologies.

My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI.  Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC.

This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn’t want to create any derivative products based upon the same.

This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments.

Merry Christmas…

Gregory Perry
Chief Executive Officer
GoVirtual Education

“VMware Training Products & Services”

540-645-6955 x111 (local)
866-354-7369 x111 (toll free)
540-931-9099 (mobile)
877-648-0555 (fax)

SOURCE

Posted by Elvis on 12/15/10 •
Section General Reading
View (0) comment(s) or add a new one
Printable viewLink to this article
Home
Page 1 of 1 pages

Statistics

Total page hits 9904826
Page rendered in 0.6587 seconds
40 queries executed
Debug mode is off
Total Entries: 3265
Total Comments: 337
Most Recent Entry: 09/25/2020 08:28 am
Most Recent Comment on: 01/02/2016 09:13 pm
Total Logged in members: 0
Total guests: 12
Total anonymous users: 0
The most visitors ever was 172 on 12/25/2019 07:40 am


Email Us

Home

Members:
Login | Register
Resumes | Members

In memory of the layed off workers of AT&T

Today's Diversion

When we reduce our own liberties to stop terrorism, the terrorists have already won. - Reverius

Search


Advanced Search

Sections

Calendar

December 2010
S M T W T F S
      1 2 3 4
5 6 7 8 9 10 11
12 13 14 15 16 17 18
19 20 21 22 23 24 25
26 27 28 29 30 31  

Must Read

Most recent entries

RSS Feeds

Today's News

ARS Technica

External Links

Elvis Picks

BLS and FRED Pages

Favorites

All Posts

Archives

RSS


Creative Commons License


Support Bloggers' Rights