OpenBSD has FBI backdoor, claims contractor

Powered by SC Magazine
 

Installed 10 years ago.

The cryptography of open source operating system OpenBSD was rigged with FBI-sponsored backdoors a decade ago, a former government contractor has told OpenBSD founder Theo De Raadt.

A 'backdoor' is an algorithm or rootkit written to allow a third party to bypass usual security controls and gain access to a system.

"I wanted to make you aware of the fact that the FBI implemented a number of backdoors," Gregory Perry, former chief technology officer at former government contractor, Netsec, told De Raadt in an email.

De Raadt on Wednesday published the emailed allegation to give others a chance to review the code and allow those claimed to be involved to defend themselves.

Code donated by Perry and his team for OpenBSD were for the "IPSEC" or internet protocol security component of the system, said De Raadt.

Perry claimed that EMC VMware evangelist, Scott Lowe, was aware of the backdoor and had been advocating OpenBSD virtual machines in VMware vSphere deployments because he was on the FBI's "payroll". Lowe, however, has denied the allegation.

Perry also warned De Raadt to review all code installed by former Netsec kernel programmer, Jason Wright, who is currently working on a security systems for SCADA for the government-run Idaho National Laboratory, according to his LinkedIn profile.

iTnews wishes to stress that allegations made against both Lowe and Wright have yet to be tested in any court of law.

Perry claimed the FBI paid Netsec to insert the backdoors which he was now free to disclose because a non-disclosure agreement with the FBI had expired.

The backdoors would allow the FBI to decipher encrypted traffic and were allegedly planted specifically to monitor the Executive Office for United States Attorneys' (EOUSA) VPN encryption system.

In an email interview with Computerworld security reporter Robert McMillan, Perry said his team were tasked with methods to reverse engineer smart card technologies and that he had led the implementation of the EOUSA's site-to-site VPN system.

He claimed the system was implemented at more than 235 Attorneys offices and has been "proved to have been backdoored by the FBI so that they could recover (potentially) grand jury information from various US Attorney sites."

Perry speculated that knowledge of the backdoor was also the reason the Defense Advanced Research Projects Agency (DARPA) in 2003 cut US$2.3 million in funding for the OpenBSD project.

De Raadt was unsure what impact the backdoors -- if true -- would have since the OpenBSD IPSEC code had undergone many alterations since the time the backdoors were allegedly installed.

Copyright © iTnews.com.au . All rights reserved.


OpenBSD has FBI backdoor, claims contractor
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 435

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 209

Vote