[Reproducible-builds] Juniper ScreenOS backdoor

[Steven Chamberlain]

Hi,

One of the reproducible builds talk slides, showed a diff of OpenSSH
before and after some off-by-one vulnerability was fixed.

Here's a real-world malicious backdoor in Juniper ScreenOS's sshd:
https://community.rapid7.com/servlet/JiveServlet/showImage/38-7376-36434/ssh.png
The yellow highlighted string allows login as any user.  Full article:
https://community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor

Whilst this may have been added in source code, it was well-disguised in
the disassembly and just 7 instructions long.  I thought this was a good
example of the current state-of-the-art, and why we'd like our binaries
and eventually, installer and VM images reproducible IMHO.

Regards,
-- 
Steven Chamberlain
steven at pyro.eu.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20151221/c4eb13ca/attachment.sig>