Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
The cryptography of open source operating system OpenBSD was rigged with FBI-sponsored backdoors a decade ago, a former government contractor has told OpenBSD founder Theo De Raadt.
A 'backdoor' is an algorithm or rootkit written to allow a third party to bypass usual security controls and gain access to a system.
"I wanted to make you aware of the fact that the FBI implemented a number of backdoors," Gregory Perry, former chief technology officer at former government contractor, Netsec, told De Raadt in an email.
De Raadt on Wednesday published the emailed allegation to give others a chance to review the code and allow those claimed to be involved to defend themselves.
Code donated by Perry and his team for OpenBSD were for the "IPSEC" or internet protocol security component of the system, said De Raadt.
Perry claimed that EMC VMware evangelist, Scott Lowe, was aware of the backdoor and had been advocating OpenBSD virtual machines in VMware vSphere deployments because he was on the FBI's "payroll". Lowe, however, has denied the allegation.
Perry also warned De Raadt to review all code installed by former Netsec kernel programmer, Jason Wright, who is currently working on a security systems for SCADA for the government-run Idaho National Laboratory, according to his LinkedIn profile.
iTnews wishes to stress that allegations made against both Lowe and Wright have yet to be tested in any court of law.
Perry claimed the FBI paid Netsec to insert the backdoors which he was now free to disclose because a non-disclosure agreement with the FBI had expired.
The backdoors would allow the FBI to decipher encrypted traffic and were allegedly planted specifically to monitor the Executive Office for United States Attorneys' (EOUSA) VPN encryption system.
In an email interview with Computerworld security reporter Robert McMillan, Perry said his team were tasked with methods to reverse engineer smart card technologies and that he had led the implementation of the EOUSA's site-to-site VPN system.
He claimed the system was implemented at more than 235 Attorneys offices and has been "proved to have been backdoored by the FBI so that they could recover (potentially) grand jury information from various US Attorney sites."
Perry speculated that knowledge of the backdoor was also the reason the Defense Advanced Research Projects Agency (DARPA) in 2003 cut US$2.3 million in funding for the OpenBSD project.
De Raadt was unsure what impact the backdoors -- if true -- would have since the OpenBSD IPSEC code had undergone many alterations since the time the backdoors were allegedly installed.
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.