U.S. Congress to federal agencies: You have two weeks to tally your backdoored Juniper kit

The House of Representatives wants to gauge the impact of the recent Juniper ScreenOS backdoors on government departments and agencies

Around two dozen U.S. government departments and federal agencies are being questioned by the U.S. Congress on whether they were using backdoored Juniper network security appliances.

In December, Juniper Networks announced that it had discovered unauthorized code added to ScreenOS, the operating system that runs on its NetScreen network firewalls. The rogue code, which remained undetected for 2 years or more, could have allowed remote attackers to gain administrative access to the vulnerable devices or to decrypt VPN connections.

The U.S. House of Representatives' Committee on Oversight and Government Reform wants to determine the impact that this issue had on government organizations and how the affected organizations responded to the incident.

The Committee sent letters on Jan. 21 to the Department of Defense, the Health Department, the State Department, the Securities and Exchange Commission (SEC), the Nuclear Regulatory Commission, NASA, the Social Security Administration, USAID and many other government agencies.

The letters ask the recipients to identify whether they used devices running the affected ScreenOS versions, to explain how they learned about the issues and whether they took any corrective actions before Juniper released patches and to specify when they applied the company's patches.

The questioned organizations have only two weeks, until Feb. 4, to respond and deliver the appropriate documents, a very tight time frame giving that "the time period covered by this request is from January 1, 2009 to the present."

Determining whether any division of a government department or agency used a vulnerable Juniper appliance for any period of time might prove difficult, especially if accurate inventories haven't been kept. For example, last year, due to inaccurate inventory records, the Internal Revenue Service did not know whether 1,300 of its computers had been upgraded away from Windows XP, which was retired by Microsoft in April 2014.

Security researchers estimate that the VPN backdoor was introduced into ScreenOS in August 2012 and the administrative access one in late 2013. Juniper has yet to reveal who and how added the unauthorized code to ScreenOS and the incident is reportedly being investigated by the FBI.

It will also be interesting to see if the Committee on Oversight and Government Reform is only interested in this particular case, or will make similar inquiries going forward. After all, intentional or unintentional backdoor-like vulnerabilities -- such as hidden administrative accounts with hard-coded, static passwords -- are frequently found in networking products from a variety of vendors, and some of them are likely used by government agencies.

Join the CSO newsletter!

Error: Please check your email address.

More about FBIHouse of RepresentativesInternal Revenue ServiceJuniperMicrosoftNASANetScreenSECSecurities and Exchange CommissionSSA

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts