[Reproducible-builds] Juniper ScreenOS backdoor
holger at layer-acht.org
Mon Dec 21 19:44:00 UTC 2015
On Montag, 21. Dezember 2015, Steven Chamberlain wrote:
> One of the reproducible builds talk slides, showed a diff of OpenSSH
> before and after some off-by-one vulnerability was fixed.
> Here's a real-world malicious backdoor in Juniper ScreenOS's sshd:
> h.png The yellow highlighted string allows login as any user. Full
https://github.com/hdm/juniper-cve-2015-7755/tree/master/firmware has links to
the actual firmware images, I would appreciate if someone could throw them
against (my.)diffoscope.org and share the links…!
> Whilst this may have been added in source code, it was well-disguised in
> the disassembly and just 7 instructions long. I thought this was a good
> example of the current state-of-the-art, and why we'd like our binaries
> and eventually, installer and VM images reproducible IMHO.
thanks for sharing this here!
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 828 bytes
Desc: This is a digitally signed message part.
More information about the Reproducible-builds