OpenBSD founder believes contractor tried to plant backdoors

OpenBSD founder believes contractor tried to plant backdoors

Summary: OpenBSD founder Theo De Raadt believes there were attempts by a contractor to plant backdoors in the open-source operating system.

SHARE:

OpenBSD founder Theo De Raadt believes there were attempts by a contractor to plant backdoors in the open-source operating system.

The startling revelation first surfaced last week when a former government contractor e-mailed DeRaadt with a claim that the FBI installed a number of back doors into the encryption software used by OpenBSD.   De Raadt went public with the e-mail and followed up with a note addressing the allegations.

"I believe that NETSEC was probably contracted to write backdoors as alleged," De Raadt said, referring to a company that accepted contracts to do security and anti-security work for parts of the U.S. government.

"If those [backdoors] were written, I don't believe they made it into our tree. They might have been deployed as their own product," De Raadt added.

The OpenBSD founder said the developers associated with NETSEC worked on drivers for the operating system and wrote security code that used these drivers.follow Ryan Naraine on twitter

Jason did not work on cryptography specifically since he was mostly a device driver author, but did touch the ipsec layer because that layer does IPCOMP as well. Meaning he touched the data-flow sides of this code, not the algorithms...

...After Jason left, Angelos (who had been working on the ipsec stack lready for 4 years or so, for he was the ARCHITECT and primary developer of the IPSEC stack) accepted a contract at NETSEC and (while travelling around the world) wrote the crypto layer that permits our ipsec stack to hand-off requests to the drivers that Jason worked on. That crypto layer contained the half-assed insecure idea of half-IV that the US govt was pushing at that time. Soon after his contract was over this was ripped out.

OpenBSD has launched a full-scale audit of the crypto code and developers have already discovered -- and fixed -- several bugs.  There were no signs of backdoor code.

OpenBSD is a Unix-like OS that descended from Berkeley Software Distribution (BSD), a Unix derivative developed at the University of California, Berkeley. It was forked from NetBSD by Theo de Raadt in late 1995.

Here is the full e-mail that kicked off the hullabaloo:

Hello Theo,

Long time no talk. If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework. At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing technologies.

My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI. Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC.

This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn't want to create any derivative products based upon the same.

This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments.

Merry Christmas...

Gregory Perry Chief Executive Officer GoVirtual Education

Topics: Software, Open Source, Operating Systems

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

26 comments
Log in or register to join the discussion
  • Close is only good in horseshoes

    Tried also
    Dietrich T. Schmitz, ~ Your Linux Advocate
    • "Close" is also good enough for ...

      @Dietrich T. Schmitz, Your Linux Advocate "Close" is also good enough for hand gernades and atomic bombs.
      Scubajrr
  • more reasons to use Linux

    The FBI, CIA and NSA could not infiltrate the linux community to plant back-doors so they went after the BSD and the low hanging fruit: windoze!
    Linux Geek
    • RE: OpenBSD founder believes contractor tried to plant backdoors

      Speaking of low hanging fruits.
      Hallowed are the Ori
      • RE: OpenBSD founder believes contractor tried to plant backdoors

        @Hallowed are the Ori
        LAMO! Keep up the good work! (And commentary!)
        That was a killer, and right on target...
        Travasaurus
    • RE: OpenBSD founder believes contractor tried to plant backdoors

      @Linux Geek That definitely has to be true! Linux is SOO isolated that nobody could EVER penetrate its defenses. There's only like a zillion different variations of Linux, so there's no way to find a weak link there. LOL
      Tiggster
      • RE: OpenBSD founder believes contractor tried to plant backdoors

        @Tiggster I am not advocating what Linux geek said, because he is completely wrong, but the variations arent really variation, the distros (ubuntu, red hat, suse etc) actually all use the same code, the difference in the distros has more to do with what packages they deliver with the OS, so they are all technically the same at the core... so really your comment should probably have been more along the lines of if they infiltrated the kernel, then every distro of linux would be affected..
        nickdangerthirdi@...
      • RE: OpenBSD founder believes contractor tried to plant backdoors

        @Tiggster ... Is that so? Then why are there over one hundred security fixes to Linux with a "must install" security rating? You sound like a fanatic.
        twayner
    • RE: OpenBSD founder believes contractor tried to plant backdoors

      @Linux Geek - you and I disagree on many things, but surely, even you can't be THAT naive? SURELY?
      bitcrazed
    • RE: OpenBSD founder believes contractor tried to plant backdoors

      @Linux Geek WOW, I didnt think there was anyone that would think that, especially someone that calls them self linux geek, I am die hard Linux user and even I am not that naive, I mean really in a community built OS you dont think the government could possibly have slipped something in? your nuts... I will go with the fact that it would probably get found faster than it would on OpenBSD, but wow... thats a crazy comment
      nickdangerthirdi@...
    • RE: OpenBSD founder believes contractor tried to plant backdoors

      @Linux Geek
      They just finished infiltrating Linux ahead of schedule and moved on.
      RedVeg
    • RE: OpenBSD founder believes contractor tried to plant backdoors

      @Linux Geek ... Oh, you of faux trust and being a follower by nature IMO, should be careful. Then too, why should they bother with such a small market share as those present, rather than where their information shows the criminals to be. I think everyone is forgetting reality here; this IS reality and it needs to be seen properly, not fanatically.
      twayner
  • RE: OpenBSD founder believes contractor tried to plant backdoors

    > security code that used these drivers

    Drivers are supposed to be there to be used, aren't they? Or is this guy just incapable of clearly expressing his theory that the drivers themselves were tampered with?
    Vesicant
  • "There were no signs of backdoor code."

    Sooooo... ipso facto<br>All the innuendos and allegations written by Mr. Gregory Perry, are false? Slanderous fabricated accusations from the overactive mind of a paranoid security type.<br><br>With no backdoor, what nefarious reason would the FBI tout any particular OS? Is it possibly a good product?<br><br>With no backdoors, does that mean Jason Wright and Scott Lowe are completely innocent of Mr. Perry's allegations? <br><br>With no backdoors, the DARPA funding had to have gone elsewhere for other reasons.<br><br>Had they wanted it planted they would've done it. <br><br>Or they knew Mr. Perry was untrustworthy and scrubbed the mission.<br><br>In conclusion, this is either an epic cyber spy conspiracy Fail, or the deluded meandering thoughts of a paranoid cyber security guard. The evidence on face value, supports the 2nd.
    invmgr@...
  • RE: OpenBSD founder believes contractor tried to plant backdoors

    An "expired NDA" with the FBI would not give someone discourse to publish confidential information that was handled during the time the NDA was in effect. I question the credibility of this story in general.
    Greg357
    • RE: OpenBSD founder believes contractor tried to plant backdoors

      @Greg357 +1
      twayner
    • RE: OpenBSD founder believes contractor tried to plant backdoors

      @Greg357
      Completely agreed. NDA relating to classified projects do NOT expire-- they do not become unclassified. The project of this boldness would certainly be classified.
      I am calling B.S. on Perry! Publish the NDA if it has in fact expired!
      gregh_z
  • RE: OpenBSD founder believes contractor tried to plant backdoors

    Drivers, in Linux at least, are kin to kernel code and run in protected kernel space. So, a driver would be a likely target for a back door.
    Tsingi
  • RE: OpenBSD founder believes contractor tried to plant backdoors

    ZDNet got hand of this before WikiLeaks? :)
    emiliosic
  • what a minute here guys

    a couple of things come up as big as a brain haemorrhage's .....

    If this is true and The GOVERNMENT put back door in open source project ??????? 2 thing neither the government is scare of open sources
    or Open bsd is too secure even for the government.


    so i find quite stupid that you people are bragging about linux or bsd or windows or anything .

    If this true a government agency are messing with open source ..... its a really big thing .

    If its because that Open bsd is so powerful that the government is scared and its afraid that enemy government or or psycho group .... that a ok

    but for any other reason ...... that very bad

    so if this is true we should all be worry .

    after if the usa goverment agency mangle with canadian open source system .......
    Quebec-french