<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Dec 22, 2015, at 8:05 AM, Henry Baker <<a href="mailto:hbaker1@pipeline.com" class="">hbaker1@pipeline.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">'The U.S. officials said they are certain U.S. spy agencies themselves aren't behind the back door'</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">'... because of the sophistication involved' ;-)</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="http://edition.cnn.com/2015/12/18/politics/juniper-networks-us-government-security-hack/index.html" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">http://edition.cnn.com/2015/12/18/politics/juniper-networks-us-government-security-hack/index.html</a></div></blockquote></div><br class=""><div class="">The full quote is </div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><blockquote type="cite" class="">The breach is believed to be the work of a foreign government, U.S. officials said, because of the sophistication involved. The U.S. officials said they are certain U.S. spy agencies themselves aren't behind the back door. China and Russia are among the top suspected governments, though officials cautioned the investigation hasn't reached conclusions.</blockquote></blockquote><br class=""></div><div class="">Considering that there are many universities that teach information security similar to the level to accomplish these feats, I think that raising this to the level of state sponsored seems premature.</div><div class=""><br class=""></div><div class="">Compare this to Stuxnet, </div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf" class="">https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf</a></div><div class="">which is broadly assumed to be state sponsored, Juniper’s transgressions are child’s play. If this is state sponsored, it is not a particularly capable state. I would leave China and Russia out unless their goal was to embarrass Juniper and get their domestic customers to stop buying foreign products.</div><div class=""><br class=""></div><div class="">In addition to the default password, we seem to be also missing the discussion about their RSA keys. </div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://eprint.iacr.org/2012/064.pdf" class="">https://eprint.iacr.org/2012/064.pdf</a></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://factorable.net/weakkeys12.extended.pdf" class="">https://factorable.net/weakkeys12.extended.pdf</a></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span></div><div class="">Not a good weak for Juniper’s security products. </div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>