Today 3pm ET, 12pm PT: Special Webcast "What you need to know about the Juniper backdoor" https://www.sans.org/webcasts/101482 We decided to move to raise our "Infocon" to yellow over the backdoor in Juniper devices. We decided to do this for a number of reasons: - Juniper devices are popular, and many organizations depend on them to defend their networks Who is affected by this issue? Juniper devices running ScreenOS 6.3.0r17 through 6.3.0r20 are affected by the fixed backdoor password (CVE-2015-7755). [1]
There are two distinct issues. First of all, affected devices can be accessed via telnet or ssh using a specific "backdoor" password. This password can not be removed or changed unless you apply Juniper's patch. Secondly, a purposely introduced weakness in the IPSEC encryption code allows an attacker familiar with the weakness to decrypt VPN traffic. [3] Is there anything I can do other than "patch"?Not really. To lower the probability of an exploit of the backdoor password, access to ssh and telnet can be restricted. Only administrative workstations should be able to connect to these systems via ssh, and nobody should be able to connect via telnet. This is "best practice" even without a backdoor. No workaround is available for the VPN decryption issue. How do I know if I am vulnerable?See the list of vulnerable ScreenOS versions available above. You can also try to log in to the device using the now known backdoor password: How do I know if I have been exploited?This login will look like any other login. Audit all logins to your Juniper devices running vulnerable versions of ScreenOS. The password has been made public yesterday (Sunday Dec 20th) evening. In particular if your device can be found in databases like Shodan, you should expect to be targeted. FoxIT released snort rules that you can use to detect exploit attempts [4]. The first signature just detected if a telnet session was established. It is not used to actually alert, but just sets the flowbit that is used by later signatures that look for the password. For the SSH login, the password is encrypted. The signature below will trigger on all SSH logins to a Juniper device and it just looks for the typical NetScreen SSH banner. alert tcp $HOME_NET 23 -> any any (msg:"FOX-SRT - Flowbit - Juniper ScreenOS telnet (noalert)"; alert tcp any any -> $HOME_NET 23 (msg:"FOX-SRT - Backdoor - Juniper ScreenOS telnet backdoor password attempt"; alert tcp $HOME_NET 22 -> $EXTERNAL_NET any (msg:"FOX-SRT - Policy - Juniper ScreenOS SSH world reachable"; References: [1] http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&actp=search
--- |
Johannes 4507 Posts ISC Handler Dec 21st 2015 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Thread locked Subscribe |
Dec 21st 2015 6 years ago |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
KUDOS! Great thread.
IC |
ICI2I 63 Posts |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Quote |
Dec 21st 2015 6 years ago |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
re: JUNIPER BACKDOOR
>>> ... effected ... This homonym is not a synonym for 'affected' -- the word that should have been used. >>> ... other then ... Sample of Fortran-77 code to try to clarify: if ( x "greater-THAN" y ) THEN write (*,*) 'True' else write (*,*) 'False' [where "greater-THAN" is coded in Fortran-77 as '.GT.'] shows the correct usage of 'THAN' and 'THEN'. ... Melvin (acting word-police & part-time Xmas-Grinch ![]() Feel free during "moderation" to DISCARD this comment. |
Anonymous |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Quote |
Dec 21st 2015 6 years ago |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
fixed. should know better by now (I keep making these same mistakes...) but Monday morning diaries
|
Johannes 4507 Posts ISC Handler |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Quote |
Dec 21st 2015 6 years ago |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Would it be fair to say that the parties potentially affected here extend beyond those who have Juniper kit to those who have data traversing VPNs with third-parties which terminate on Juniper kit, and thus clear-text passwords and anything else traversing such tunnels may be compromised?
|
Marquis 7 Posts |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Quote |
Dec 23rd 2015 6 years ago |
Sign Up for Free or Log In to start participating in the conversation!