In December 2015, Juniper Networks disclosed that it had found unauthorized code in ScreenOS - the operating system running on its NetScreen VPN firewall appliances. The code had been there since at least 2012, possibly since 2008. It included two separate backdoors: one that could be used to log into any NetScreen device using a hardcoded administrative password, and one that was more subtle and more significant - a modification to the Dual EC DRBG random number generator that changed the generator's parameters. This second backdoor was designed to allow someone with knowledge of the changed parameters to decrypt VPN traffic that had been protected by that generator.

The investigation into the second backdoor led researchers to a remarkable conclusion. The Dual EC DRBG algorithm contained a known backdoor inserted by the NSA - a backdoor the NSA had advocated for being included in cryptographic standards. The Juniper backdoor appeared to have taken the NSA's algorithm, replaced the NSA's specific parameters with different parameters, and thereby created a backdoor accessible to the new attacker rather than to the NSA. In other words: someone had stolen and repurposed the NSA's backdoor. Intelligence agencies and researchers believe the most likely culprit is a foreign intelligence service - probably China or Russia. The mechanism existed because the NSA had compromised the cryptographic standards process. The downstream harm was caused by someone else using that compromise against the US government and its network infrastructure.

The Two Backdoors

Juniper described finding "two issues" in the December 2015 advisory. The first was a simple administrative password backdoor: ScreenOS would accept a specific hardcoded password to log in as an administrator. This is a crude but effective backdoor - anyone who knew the password could log into any NetScreen device globally. The password was eventually identified by security researchers: "<<< %s(un='%s') = %u". NetScreen devices were widely deployed by US government agencies, enterprise customers, and telecommunications providers.

The second backdoor was in the random number generator. ScreenOS used Dual EC DRBG (Dual Elliptic Curve Deterministic Random Bit Generator) as its cryptographic random number source. The NSA had advocated strongly for Dual EC DRBG's inclusion in the NIST SP 800-90A standard, and post-Snowden disclosure established that the NSA had inserted a backdoor: the algorithm includes two public elliptic curve points (P and Q) that the NSA had selected. If you know the discrete log relationship between P and Q (which only the selector of those points knows), you can predict all future outputs of the generator from observing a small amount of output. This allows passive decryption of VPN traffic protected by keys derived from that generator.

Juniper's ScreenOS was using Dual EC DRBG. Someone had modified the code to change the specific Q point used in the algorithm. The original Juniper code used a Q point that was not the standard NIST value (ScreenOS had already changed it, possibly intentionally). The backdoor replaced that Q point with yet another value. Whoever chose the replacement Q point knew the discrete log relationship - and therefore could decrypt all VPN traffic protected by keys generated after the modification. They had effectively created their own version of the NSA backdoor.

[TECHNICAL NOTE]
The Dual EC DRBG backdoor is among the most technically sophisticated documented cryptographic compromises in history. The algorithm works as follows: given two elliptic curve points P and Q, where e is the secret discrete logarithm such that Q = e*P, a generator state s produces output r = x(s*P) and next state s' = x(s*Q). An observer who knows e can compute e*r = e * x(s*P) = x(e*s*P) = x(s*eP) = x(s*Q) = s'. Knowing s', they can reproduce all future outputs. This requires knowledge only of some output - observable from a captured handshake - and e (the secret). The NSA knew e for the original standard parameters. The Juniper modifier chose their own P and Q (with their own e) and substituted them. The NIST standard for Dual EC DRBG was finalized in 2006 after sustained NSA advocacy. Academic cryptographers had publicly noted in 2007 (Shumow and Ferguson at CRYPTO 2007) that the algorithm contained a potential backdoor if the parameter selector knew the discrete log. The NSA's involvement in selecting the parameters was established by Snowden documents in 2013. Juniper's ScreenOS had been using modified EC parameters since at least 2008. The full history of who modified Juniper's parameters and exactly when represents one of the most detailed documented cases of offensive cyber operations affecting cryptographic infrastructure.

Attribution and the Cascade Effect

Attribution for the Juniper backdoor has never been formally established by US officials, but reporting from multiple sources has pointed to China as the most likely suspect for the Dual EC backdoor modification, with the NSA as the suspected source of the original administrative password backdoor. The sequence of events would be: NSA inserted or assisted in inserting the administrative password backdoor (or the capability was built to allow NSA access); a foreign intelligence service (likely China) subsequently discovered the Dual EC implementation in ScreenOS, recognized it as using the Dual EC DRBG approach, and inserted their own modified Q point.

The administrative backdoor password has never been formally attributed. Some researchers have noted that the format of the password string ("<<< %s(un='%s') = %u") looks like debugging code that might have been left in accidentally, while others note that it functions as a fully working administrative password and is unlikely to be accidental. Juniper stated it was unauthorized code.

The Juniper backdoor was present for approximately three to seven years before discovery. During that time, Juniper NetScreen devices were deployed by US government agencies, the Department of Defense, and US intelligence community contractors as well as by commercial enterprises. The potential scope of VPN traffic that could have been decrypted by whoever controlled the Dual EC backdoor is significant and not publicly quantified.

[WARNING]
The Juniper backdoor is the clearest documented example of the "turning offense against defense" problem in cryptographic standards - a vulnerability the security community has discussed theoretically for decades became concrete reality. The NSA's strategy of inserting backdoors in standards (documented in the Snowden files) depended on the secrecy of the backdoor mechanism. Once the mechanism was known (published academically in 2007, confirmed by Snowden documents in 2013), it became possible for adversaries to replicate it. The NSA's use of Dual EC DRBG as an intelligence tool depended on the algorithm being deployed in commercial products - which required the NSA to promote the algorithm as legitimate cryptographic infrastructure. By getting the algorithm standardized and deployed, the NSA created the opportunity for adversaries to use the same technique. This is the fundamental tension in the NSA's dual role: the "Defend" mission (protecting US communications infrastructure) conflicts with the "Exploit" mission (creating vulnerabilities for offensive use). The Juniper case is the clearest example of the Exploit mission creating a vulnerability that the Defend mission was then unable to close before adversaries exploited it. The Vulnerabilities Equities Process, which theoretically governs these tradeoffs, was not designed to handle vulnerabilities created by deliberately compromising cryptographic standards.
[IOC]
Juniper ScreenOS backdoor summary: discovered December 2015 by Juniper during internal code review. Affected product: NetScreen VPN firewall appliances running ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20. Backdoor 1: hardcoded administrative password (identified as "<<< %s(un='%s') = %u") allowing SSH/Telnet admin login to any NetScreen device. Backdoor 2: modified Dual EC DRBG Q parameter enabling passive VPN traffic decryption by anyone knowing the discrete log of modified Q. Timeframe in code: at least 2012 for administrative password; 2008 for Dual EC modification (per code inspection of earlier versions). Attribution (administrative password): suspected NSA, not confirmed. Attribution (Dual EC modification): suspected China or other foreign intelligence service, not confirmed. Impact: NetScreen devices used by US government, DoD, intelligence community contractors, and enterprises. Decryptable traffic scope: all VPN sessions using ScreenOS random number generation during the backdoor's presence - not quantified. Remediation: Juniper released patches December 2015; advisory recommended treating all pre-patch VPN traffic as potentially compromised. Follow-on: Juniper removed Dual EC DRBG from ScreenOS entirely. NIST subsequently withdrew Dual EC DRBG from the SP 800-90A standard. RSA Security settled with US government for $10M after Snowden documents revealed they had accepted NSA payment to use Dual EC DRBG as the default RNG in their BSAFE library.