OpenBSD has FBI backdoor, claims contractor

Installed 10 years ago.

The cryptography of open source operating system OpenBSD was rigged with FBI-sponsored backdoors a decade ago, a former government contractor has told OpenBSD founder Theo De Raadt.

A 'backdoor' is an algorithm or rootkit written to allow a third party to bypass usual security controls and gain access to a system.

"I wanted to make you aware of the fact that the FBI implemented a number of backdoors," Gregory Perry, former chief technology officer at former government contractor, Netsec, told De Raadt in an email.

De Raadt on Wednesday published the emailed allegation to give others a chance to review the code and allow those claimed to be involved to defend themselves.

Code donated by Perry and his team for OpenBSD were for the "IPSEC" or internet protocol security component of the system, said De Raadt.

Perry claimed that EMC VMware evangelist, Scott Lowe, was aware of the backdoor and had been advocating OpenBSD virtual machines in VMware vSphere deployments because he was on the FBI's "payroll". Lowe, however, has denied the allegation.

Perry also warned De Raadt to review all code installed by former Netsec kernel programmer, Jason Wright, who is currently working on a security systems for SCADA for the government-run Idaho National Laboratory, according to his LinkedIn profile.

iTnews wishes to stress that allegations made against both Lowe and Wright have yet to be tested in any court of law.

Perry claimed the FBI paid Netsec to insert the backdoors which he was now free to disclose because a non-disclosure agreement with the FBI had expired.

The backdoors would allow the FBI to decipher encrypted traffic and were allegedly planted specifically to monitor the Executive Office for United States Attorneys' (EOUSA) VPN encryption system.

In an email interview with Computerworld security reporter Robert McMillan, Perry said his team were tasked with methods to reverse engineer smart card technologies and that he had led the implementation of the EOUSA's site-to-site VPN system.

He claimed the system was implemented at more than 235 Attorneys offices and has been "proved to have been backdoored by the FBI so that they could recover (potentially) grand jury information from various US Attorney sites."

Perry speculated that knowledge of the backdoor was also the reason the Defense Advanced Research Projects Agency (DARPA) in 2003 cut US$2.3 million in funding for the OpenBSD project.

De Raadt was unsure what impact the backdoors -- if true -- would have since the OpenBSD IPSEC code had undergone many alterations since the time the backdoors were allegedly installed.