OpenBSD founder Theo De Raadt believes there were attempts by a contractor to plant backdoors in the open-source operating system.
The startling revelation first surfaced last week when a former government contractor e-mailed DeRaadt with a claim that the FBI installed a number of back doors into the encryption software used by OpenBSD. De Raadt went public with the e-mail and followed up with a note addressing the allegations.
“I believe that NETSEC was probably contracted to write backdoors as alleged,” De Raadt said, referring to a company that accepted contracts to do security and anti-security work for parts of the U.S. government.
“If those [backdoors] were written, I don’t believe they made it into our tree. They might have been deployed as their own product,” De Raadt added.
The OpenBSD founder said the developers associated with NETSEC worked on drivers for the operating system and wrote security code that used these drivers.
Jason did not work on cryptography specifically since he was mostly a device driver author, but did touch the ipsec layer because that layer does IPCOMP as well. Meaning he touched the data-flow sides of this code, not the algorithms…
…After Jason left, Angelos (who had been working on the ipsec stack lready for 4 years or so, for he was the ARCHITECT and primary developer of the IPSEC stack) accepted a contract at NETSEC and
(while travelling around the world) wrote the crypto layer that permits our ipsec stack to hand-off requests to the drivers that Jason worked on. That crypto layer contained the half-assed insecure idea of half-IV that the US govt was pushing at that time. Soon after his contract was over this was ripped out.
OpenBSD has launched a full-scale audit of the crypto code and developers have already discovered — and fixed — several bugs. There were no signs of backdoor code.
OpenBSD is a Unix-like OS that descended from Berkeley Software Distribution (BSD), a Unix derivative developed at the University of California, Berkeley. It was forked from NetBSD by Theo de Raadt in late 1995.
Here is the full e-mail that kicked off the hullabaloo:
Hello Theo,
Long time no talk. If you will recall, a while back I was the CTO at
NETSEC and arranged funding and donations for the OpenBSD Crypto
Framework. At that same time I also did some consulting for the FBI,
for their GSA Technical Support Center, which was a cryptologic
reverse engineering project aimed at backdooring and implementing key
escrow mechanisms for smart card and other hardware-based computing
technologies.
My NDA with the FBI has recently expired, and I wanted to make you
aware of the fact that the FBI implemented a number of backdoors and
side channel key leaking mechanisms into the OCF, for the express
purpose of monitoring the site to site VPN encryption system
implemented by EOUSA, the parent organization to the FBI. Jason
Wright and several other developers were responsible for those
backdoors, and you would be well advised to review any and all code
commits by Wright as well as the other developers he worked with
originating from NETSEC.
This is also probably the reason why you lost your DARPA funding, they
more than likely caught wind of the fact that those backdoors were
present and didn’t want to create any derivative products based upon
the same.
This is also why several inside FBI folks have been recently
advocating the use of OpenBSD for VPN and firewalling implementations
in virtualized environments, for example Scott Lowe is a well
respected author in virtualization circles who also happens top be on
the FBI payroll, and who has also recently published several tutorials
for the use of OpenBSD VMs in enterprise VMware vSphere deployments.
Merry Christmas…
Gregory Perry
Chief Executive Officer
GoVirtual Education
