OpenBSD has FBI backdoor, claims contractor

Powered by SC Magazine
 

Installed 10 years ago.

The cryptography of open source operating system OpenBSD was rigged with FBI-sponsored backdoors a decade ago, a former government contractor has told OpenBSD founder Theo De Raadt.

A 'backdoor' is an algorithm or rootkit written to allow a third party to bypass usual security controls and gain access to a system.

"I wanted to make you aware of the fact that the FBI implemented a number of backdoors," Gregory Perry, former chief technology officer at former government contractor, Netsec, told De Raadt in an email.

De Raadt on Wednesday published the emailed allegation to give others a chance to review the code and allow those claimed to be involved to defend themselves.

Code donated by Perry and his team for OpenBSD were for the "IPSEC" or internet protocol security component of the system, said De Raadt.

Perry claimed that EMC VMware evangelist, Scott Lowe, was aware of the backdoor and had been advocating OpenBSD virtual machines in VMware vSphere deployments because he was on the FBI's "payroll". Lowe, however, has denied the allegation.

Perry also warned De Raadt to review all code installed by former Netsec kernel programmer, Jason Wright, who is currently working on a security systems for SCADA for the government-run Idaho National Laboratory, according to his LinkedIn profile.

iTnews wishes to stress that allegations made against both Lowe and Wright have yet to be tested in any court of law.

Perry claimed the FBI paid Netsec to insert the backdoors which he was now free to disclose because a non-disclosure agreement with the FBI had expired.

The backdoors would allow the FBI to decipher encrypted traffic and were allegedly planted specifically to monitor the Executive Office for United States Attorneys' (EOUSA) VPN encryption system.

In an email interview with Computerworld security reporter Robert McMillan, Perry said his team were tasked with methods to reverse engineer smart card technologies and that he had led the implementation of the EOUSA's site-to-site VPN system.

He claimed the system was implemented at more than 235 Attorneys offices and has been "proved to have been backdoored by the FBI so that they could recover (potentially) grand jury information from various US Attorney sites."

Perry speculated that knowledge of the backdoor was also the reason the Defense Advanced Research Projects Agency (DARPA) in 2003 cut US$2.3 million in funding for the OpenBSD project.

De Raadt was unsure what impact the backdoors -- if true -- would have since the OpenBSD IPSEC code had undergone many alterations since the time the backdoors were allegedly installed.

Copyright © iTnews.com.au . All rights reserved.


OpenBSD has FBI backdoor, claims contractor
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 337

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  57%
 
No
  43%
TOTAL VOTES: 140

Vote