Ho-hum! FBI postavio backdoor u OpenBSD prije 10 godina?

[Davorin Vlahovic]

De Raadt received the email from Gregory Perry, currently the CEO of
GoVirtual Education. Ten years ago, while he was CTO at NETSEC, Perry did
some consulting work for the FBI's GSA Technical Support Center. Perry's NDA
expired recently, and as such, he decided to contact De Raadt about what he
had learned ten years ago.

"My NDA with the FBI has recently expired, and I wanted to make you aware of
the fact that the FBI implemented a number of backdoors and side channel key
leaking mechanisms into the OCF, for the express purpose of monitoring the
site to site VPN encryption system implemented by EOUSA, the parent
organization to the FBI," Perry details in the email, "Jason Wright and
several other developers were responsible for those backdoors, and you would
be well advised to review any and all code commits by Wright as well as the
other developers he worked with originating from NETSEC."

"This is also why several inside FBI folks have been recently advocating the
use of OpenBSD for VPN and firewalling implementations in virtualized
environments," he adds, "For example Scott Lowe is a well respected author in
virtualization circles who also happens top be on the FBI payroll, and who
has also recently published several tutorials for the use of OpenBSD VMs in
enterprise VMware vSphere deployments."


http://www.osnews.com/story/24136/_FBI_Added_Secret_Backdoors_to_OpenBSD_IPSEC_

[Davorin Vlahovic]

Post by Davorin Vlahovic
http://www.osnews.com/story/24136/_FBI_Added_Secret_Backdoors_to_OpenBSD_IPSEC_

Ignoring motive, and looking at opportunity:

We have never allowed US citizens or foreign citizens working in the US
to hack on crypto code (Niels Provos used to make trips to Canada to
develop OpenSSH for this reason), so direct interference in the crypto
code is unlikely. It would also be fairly obvious - the crypto code
works as pretty basic block transform API, and there aren't many places
where one could smuggle key bytes out. We always used arcrandom() for
generating random numbers when we needed them, so deliberate biases of
key material, etc would be quite visible.

So a subverted developer would probably need to work on the network stack.
I can think of a few obvious ways that they could leak plaintext or key
material:

1. Ensure that key bytes somehow wind up as padding. This would be pretty
obvious, since current IPsec standards require deterministic padding.
Our legacy random padding uses arc4random_buf().

2. Arrange for particular structures to be adjacent to interesting data,
like raw or scheduled keys and "accidentally" copy too much.

3. Arrange for mbufs that previously contained plaintext or other
interesting material to be "accidentally" reused. This seems to me the
most likely avenue, and there have been bugs of this type found before.
It's a pretty common mistake, so it is attractive for deniability, but
it seems difficult to make this a reliable exploit. If I was doing it,
I'd try to make the reuse happen on something like ICMP errors, so I
could send error-inducing probe packets at times I thought were
interesting :)

4. Introduce timing side-channel leaks. These weren't widely talked about
back in 2000 (at least not in the public domain), but have been well
researched in the years since then. We have already introduced
countermeasures against the obvious memcmp() leaks using
timingsafe_bcmp(), but more subtle leaks could still remain.

If anyone is concerned that a backdoor may exist and is keen to audit the
network stack, then these are the places I'd recommend starting from.

http://marc.info/?l=openbsd-tech&m=129237675106730&w=2

[Ivan Tisljar (work)]

Post by Davorin Vlahovic
"My NDA with the FBI has recently expired, and I wanted to make you aware of
the fact that the FBI implemented a number of backdoors and side channel key
leaking mechanisms into the OCF, for the express purpose of monitoring the
site to site VPN encryption system implemented by EOUSA, the parent
organization to the FBI"

Ups.

Ne vidim da itko komentira, vjerujem da OpenBSD nije toliko popularan
među korisnicima - nego, koji ono BSD je OSX uzeo za bazu?

Ivan

[Vedran Furač]

Post by Davorin Vlahovic
"My NDA with the FBI has recently expired, and I wanted to make you aware of
the fact that the FBI implemented a number of backdoors and side channel key
leaking mechanisms into the OCF, for the express purpose of monitoring the

Open source... "Given enough eyeballs, all backdoors are shallow"? :D

Post by Davorin Vlahovic
"This is also why several inside FBI folks have been recently advocating the
use of OpenBSD for VPN and firewalling implementations in virtualized
environments," he adds, "For example Scott Lowe is a well respected author in
virtualization circles who also happens top be on the FBI payroll, and who
has also recently published several tutorials for the use of OpenBSD VMs in
enterprise VMware vSphere deployments."

Tko se još usudi reći da open source programeri nisu plaćeni za svoj rad. :D

[Davorin Vlahovic]

Post by Vedran Furač

Post by Davorin Vlahovic
"My NDA with the FBI has recently expired, and I wanted to make you aware of
the fact that the FBI implemented a number of backdoors and side channel key
leaking mechanisms into the OCF, for the express purpose of monitoring the

Open source... "Given enough eyeballs, all backdoors are shallow"? :D

Realno gledajuci, to i dalje vrijedi, a vrijedi pogotovo za OpenBSD. Ako je
istina to sto govore stvar gotovo sigurno nije u sourceu nego u npr.
koristenju posebno postimanih konstanti za prim-brojeve ili je implementirana
neka sideband sitnica koja ovisi o nekom nedokumentiranom "featureu"
hardvera.

Znas kako se kaze, za debugging moras biti duplo pametniji od onog tko pise
source, pa ako pises svoj source najpametnije sto znas po defaultu nisi
dovoljno pametan da debuggiras svoj kod :)

[Veselko Pritiskovic]

Jel ovo potvđeno od strane OpenSource zajednice?

[Davorin Vlahovic]

Post by Veselko Pritiskovic
Jel ovo potvđeno od strane OpenSource zajednice?

Nije. Nasli su neke bugove (njih uvijek ima), ali jos nisu nista potvrdili.
Moguce je cak da su ispravili stvar nekim bughuntom ranije ako je i
postojala.