Toto deVeer Posted December 16, 2010 Share Posted December 16, 2010 Apparently, the OpenBSD developers accepted money from the FBI to install a backdoor in the OpenBSD IPSEC around 2000-2001. This code has been used in other operating systems from time to time. And you thought that your non-proprietary code was secure? Think again... For the uninitiated, BSD is a Unix operating system variant not unlike the Linux OS. It is completely free and was also used as the basis of the various modern Apple operating systems. I also understand that Microsoft used it within Windows 2000 but I'm not sure how much of it remains in Windows 7. IPSEC is short for Internet Protocol Security, I believe. You can see this is a BIG deal. email here, excerpted below: From: Theo de Raadt <deraadt <at> cvs.openbsd.org>Subject: Allegations regarding OpenBSD IPSEC Newsgroups: gmane.os.openbsd.tech Date: 2010-12-14 22:24:39 GMT (1 day, 10 hours and 12 minutes ago) I have received a mail regarding the early development of the OpenBSD IPSEC stack. It is alleged that some ex-developers (and the company they worked for) accepted US government money to put backdoors into our network stack, in particular the IPSEC stack. Around 2000-2001. Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products. Over 10 years, the IPSEC code has gone through many changes and fixes, so it is unclear what the true impact of these allegations are. The mail came in privately from a person I have not talked to for nearly 10 years. I refuse to become part of such a conspiracy, and will not be talking to Gregory Perry about this. Therefore I am making it public so that a. those who use the code can audit it for these problems, b. those that are angry at the story can take other actions, c. if it is not true, those who are being accused can defend themselves. Of course I don't like it when my private mail is forwarded. However the "little ethic" of a private mail being forwarded is much smaller than the "big ethic" of government paying companies to pay open source developers ( a member of a community-of-friends ) to insert privacy-invading holes in software. ---- From: Gregory Perry <Gregory.Perry <at> GoVirtual.tv> To: "deraadt <at> openbsd.org" <deraadt <at> openbsd.org> Subject: OpenBSD Crypto Framework Thread-Topic: OpenBSD Crypto Framework Thread-Index: AcuZjuF6cT4gcSmqQv+Fo3/+2m80eg== Date: Sat, 11 Dec 2010 23:55:25 +0000 Message-ID: <8D3222F9EB68474DA381831A120B1023019AC034 <at> mbx021-e2-nj-5.exch021.domain.local> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Status: RO Hello Theo, Long time no talk. If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework. At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing technologies. My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI. Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC. This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn't want to create any derivative products based upon the same. This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments. Merry Christmas... Gregory Perry Chief Executive Officer GoVirtual Education Link to comment Share on other sites More sharing options...
rxe Posted December 16, 2010 Share Posted December 16, 2010 If true (and that is a big IF), this is a very big deal, and represents part of the "growing up" of Open Source. The idea as been that because you can see the source, you can find the bugs and backdoors yourself. Of course, unless you have a solid crypto background and many hours to go through the code...you're just going to run it like everyone else. Expect to see some rapid patching in the near future (if true....). The FBI and the like do have a big problem looming as hard crypto is easy to implement and cheap to run these days. We will soon get to a point where everything is encrypted by default and that will make sorting out the bad guys from the good.....rather hard. Link to comment Share on other sites More sharing options...
Toto deVeer Posted December 16, 2010 Author Share Posted December 16, 2010 If true (and that is a big IF), this is a very big deal, and represents part of the "growing up" of Open Source. The idea as been that because you can see the source, you can find the bugs and backdoors yourself. Of course, unless you have a solid crypto background and many hours to go through the code...you're just going to run it like everyone else. Expect to see some rapid patching in the near future (if true....). The FBI and the like do have a big problem looming as hard crypto is easy to implement and cheap to run these days. We will soon get to a point where everything is encrypted by default and that will make sorting out the bad guys from the good.....rather hard. It will take a long time to ferret this out. I'm sure that there are developers digging into it as we speak, but the IPSec code is somewhat ubiquitous, and there is a 10 year code base installed... Link to comment Share on other sites More sharing options...
porca misèria Posted December 16, 2010 Share Posted December 16, 2010 OpenBSD is not FreeBSD! This is worse than accusing a Scot of being English, or a Canadian of being American! Yes, MacOS is basically BSD, and Windows snarfed their networking (and broke it, leaving windows users at the mercy of lots of apps that tend to be a nightmare to use together on the same machine). Linux is different (google SCO for someone who spent many millions trying to 'prove' otherwise) and I'd expect non-BSD legacy Unix to be different too. [edit to add] OpenBSD has a track record of fanatical pseudo-religious fundamentalism over what software it accepts: see for example http://marc.info/?l=openbsd-misc&m=108653020220858&w=2 . Not even the mainstream-fundamentalist Debian GNU/Linux distro goes in for that kind of thing. Link to comment Share on other sites More sharing options...
Traktion Posted December 16, 2010 Share Posted December 16, 2010 I'd be quite surprised if no one spotted the code over the years, but at least it has been highlighted now. Who knows what is in Windows and I doubt we will ever find out. Link to comment Share on other sites More sharing options...
Toto deVeer Posted December 16, 2010 Author Share Posted December 16, 2010 OpenBSD is not FreeBSD! This is worse than accusing a Scot of being English, or a Canadian of being American! Yes, MacOS is basically BSD, and Windows snarfed their networking (and broke it, leaving windows users at the mercy of lots of apps that tend to be a nightmare to use together on the same machine). Linux is different (google SCO for someone who spent many millions trying to 'prove' otherwise) and I'd expect non-BSD legacy Unix to be different too. Good point, thank you for the clarification. The way open source code gets used, is it not possible that the IPSEC code has been used by hundreds, if not thousands, of applications? Edit: OP corrected. Thanks for pointing that out. Link to comment Share on other sites More sharing options...
Hoggums Posted December 16, 2010 Share Posted December 16, 2010 I think this is just the usual internet scare mongering. You open a back door to the FBI, you open the same door to hackers and malicious software. It's such a flagrant security risk. Link to comment Share on other sites More sharing options...
Traktion Posted December 16, 2010 Share Posted December 16, 2010 OpenBSD is not FreeBSD! This is worse than accusing a Scot of being English, or a Canadian of being American! Yes, MacOS is basically BSD, and Windows snarfed their networking (and broke it, leaving windows users at the mercy of lots of apps that tend to be a nightmare to use together on the same machine). Linux is different (google SCO for someone who spent many millions trying to 'prove' otherwise) and I'd expect non-BSD legacy Unix to be different too. I don't know much about OpenBSD - I've only had fleeting exposure to FreeBSD too. Is OpenBSD open source or is it part proprietary? Link to comment Share on other sites More sharing options...
Toto deVeer Posted December 16, 2010 Author Share Posted December 16, 2010 I don't know much about OpenBSD - I've only had fleeting exposure to FreeBSD too. Is OpenBSD open source or is it part proprietary? "OpenBSD is a Unix-like computer operating system descended from Berkeley Software Distribution (BSD), a Unix derivative developed at the University of California, Berkeley. It was forked from NetBSD by project leader Theo de Raadt in late 1995. The project is widely known for the developers' insistence on open source code and quality documentation, uncompromising position on software licensing, and focus on security and code correctness. The project is coordinated from de Raadt's home in Calgary, Alberta, Canada. Its logo and mascot is a pufferfish named Puffy. OpenBSD includes a number of security features absent or optional in other operating systems, and has a tradition in which developers audit the source code for software bugs and security problems. The project maintains strict policies on licensing and prefers the open-source BSD licence and its variants—in the past this has led to a comprehensive licence audit and moves to remove or replace code under licences found less acceptable. .... The OpenBSD project maintains ports for 17 different hardware platforms, including the DEC Alpha, Intel i386, Hewlett-Packard PA-RISC, AMD AMD64 and Motorola 68000 processors, Apple's PowerPC machines, Sun SPARC and SPARC64-based computers, the VAX and the Sharp Zaurus." (source Wikipedia) Link to comment Share on other sites More sharing options...
Charlie Don't Surf Posted December 16, 2010 Share Posted December 16, 2010 If this was true hackers would have found and exploited it many years ago Link to comment Share on other sites More sharing options...
SarahBell Posted December 16, 2010 Share Posted December 16, 2010 Yeah if there was a door other people would be using it by now. Link to comment Share on other sites More sharing options...
Toto deVeer Posted December 16, 2010 Author Share Posted December 16, 2010 This issue will have to be put to rest in some way, however. I see no reason why Perry would fabricate this matter. Perry sent the email as a private communication, it seems. Link to comment Share on other sites More sharing options...
erranta Posted December 16, 2010 Share Posted December 16, 2010 Apparently, the OpenBSD developers accepted money from the FBI to install a backdoor in the OpenBSD IPSEC around 2000-2001. This code has been used in other operating systems from time to time. And you thought that your non-proprietary code was secure? Think again... For the uninitiated, BSD is a Unix operating system variant not unlike the Linux OS. It is completely free and was also used as the basis of the various modern Apple operating systems. I also understand that Microsoft used it within Windows 2000 but I'm not sure how much of it remains in Windows 7. IPSEC is short for Internet Protocol Security, I believe. You can see this is a BIG deal. email here, excerpted below: It's about time you all woke up to the fact M/soft/Linux(biblical ref)/Apple(biblical ref)/Oracle/Java/Google/Adobe(mud/clay(biblical hint)) are all the same Satanic Big Bruvver machination on a secret level - the competition between them is the illu-sion! J-AVA eve=ava Ava is a feminine given name derived from the name Eve [AVA-TAR] Eve - (logo) chunk bitten out of 'Apple' signifies? The list of Irenaeus commences with Linus, whom he identifies with the person of this name mentioned by Paul, and whom he states to have been "entrusted with the office of the bishopric of Rome by the apostles" "And I also say to you that you are Peter, and on this rock I will build My church, and the GATES of Hades shall not prevail against it" (Mt. 16:18). (BiLL - WiLLiam the Orange One!) Link to comment Share on other sites More sharing options...
athe Posted December 16, 2010 Share Posted December 16, 2010 This issue will have to be put to rest in some way, however. I see no reason why Perry would fabricate this matter. Perry sent the email as a private communication, it seems. More free advertising for his company that he could ever have dreamt of? For what it's worth, various people seem to have started poking holes in Perry's claims. Link to comment Share on other sites More sharing options...
the_duke_of_hazzard Posted December 16, 2010 Share Posted December 16, 2010 I was involved in a government project that went live and resulted in users' details being swapped in a financial context. Ministers from the relevant country were quizzed on national news and there was a lot of pressure and attention on us. After a few extremely hairy days debugging we discovered that it was a flaw in an extremely widely used operating system and supported application that had been there for a while. It was relatively easy to spot and exploit. It barely registered for the OS company and their response was fairly tardy to say the least. (No, it was not M$) Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.