In December 2015, Juniper Networks disclosed that it had discovered "unauthorized code" in ScreenOS, the operating system running on its NetScreen VPN appliances - hardware widely used by government agencies, defense contractors, and large enterprises for encrypted remote access. The unauthorized code contained two backdoors: one that allowed anyone with SSH or Telnet access to authenticate with a hardcoded master password, and one that allowed passive decryption of all VPN traffic through the device. Juniper had not put this code there. Someone had covertly modified its product.

The investigation that followed produced what is arguably the most technically complex and politically significant backdoor story in the history of network security. The passive VPN decryption backdoor exploited a vulnerability in Dual EC DRBG, an NSA-designed cryptographic random number generator that the NSA had successfully lobbied to be included in cryptographic standards - a generator that the NSA had secretly backdoored by choosing parameters it knew would make the generated numbers predictable to anyone who possessed a second parameter that only the NSA held. Someone had then modified Juniper's ScreenOS to use those specific NSA parameters, and changed the second parameter to one they controlled, effectively stealing the NSA's backdoor for their own use.

Dual EC DRBG: The NSA's Backdoored RNG

Dual Elliptic Curve Deterministic Random Bit Generator was published as NIST Special Publication 800-90A in 2006. Random number generation is foundational to cryptography - the security of cryptographic keys depends on the unpredictability of the random numbers used to generate them. A predictable random number generator means predictable keys, which means breakable encryption.

Dual EC DRBG works with two elliptic curve points, P and Q. The mathematical relationship between P and Q determines whether the generator is backdoorable. If an attacker knows the value e such that Q = e*P, they can observe the generator's output and reconstruct its internal state, predicting all future outputs. If P and Q are independently chosen random points, no one can find e. If Q is specifically constructed as e*P for a known e, the constructor effectively holds a master key.

NIST published Dual EC DRBG with specific P and Q constants and no explanation of how they were chosen. Cryptographers, including Dan Shumow and Niels Ferguson, publicly raised the backdoor concern in 2007 - pointing out that if Q was constructed this way, the generator would be compromised, and there was no way to verify it wasn't. The warning was public and largely ignored by the industry. RSA Security licensed Dual EC DRBG in its BSAFE cryptographic library and, according to a 2013 Reuters investigation, received $10 million from the NSA to make it the default generator - a deal that gave the NSA backdoor access to any product using BSAFE for TLS.

[INFO]
The 2013 Snowden documents included an NSA internal document describing Dual EC DRBG as an NSA project that had been "inserted" into the NIST standard. The document described it as a way to "influence" international cryptographic standards. After the Snowden disclosure, NIST reopened the review of 800-90A and ultimately deprecated Dual EC DRBG. RSA Security advised its customers to stop using BSAFE's default settings. The cryptographic community's reaction to the episode was profound: it confirmed that government agencies had successfully inserted backdoors into widely-deployed cryptographic standards, and raised questions about what other standards might be similarly compromised.

The ScreenOS Backdoor Chain

Juniper had included Dual EC DRBG in ScreenOS - but had initially used different P and Q constants than the NSA's published standards. The unauthorized code discovered in 2015 changed those constants to the NSA's standard Q point, the one that the NSA's backdoor key could exploit. But it also changed a third parameter that the passive decryption technique required, to a new value - meaning that whoever inserted the code now held the master key, not the NSA.

This is the remarkable part of the story: the modification effectively transferred the NSA's backdoor to whoever inserted it. They would have needed to know that Dual EC DRBG was backdoored (non-public knowledge in 2008 when the code appears to have been inserted), know the specific technique for exploiting it, and understand Juniper's ScreenOS implementation well enough to modify it. The sophistication required pointed to another nation-state intelligence agency.

The most widely accepted attribution, based on reporting from Reuters and multiple security researchers, was China - specifically that Chinese intelligence (likely MSS) had inserted the code, either through a supply chain compromise, through recruitment of an insider at Juniper, or through access to Juniper's development systems. The code was present in ScreenOS versions from 2008 to 2015 - seven years of compromised VPN appliances in government and enterprise networks worldwide.

The Hardcoded Password Backdoor

The second backdoor - the SSH/Telnet authentication bypass - was simpler and more immediately dangerous. An undocumented password string "<<< %s(un='%s') = %u" would authenticate anyone who entered it as an administrator on any NetScreen device. This backdoor could be exploited by any attacker with network access to the device's management interface, requiring no cryptographic knowledge.

The origin of this password was traced by researchers who found that the same string appeared in older ScreenOS source code without appearing to be intentional. The researchers hypothesized that the unauthorized modification had repurposed debug code that happened to be an authentication bypass. This would mean the hardcoded password was opportunistic rather than deliberately designed - the attackers recognized an existing vulnerability and promoted it to a full backdoor by activating it.

Both backdoors were patched in Juniper's December 2015 update. The disclosure itself was the first public confirmation that a major network vendor's firmware had been persistently compromised for years - though the NSA's ANT catalog, disclosed by Snowden, had described similar capabilities and implants that the NSA itself deployed.

[WARNING]
The Juniper backdoor was in the device firmware - not in configuration or application software. Most security monitoring focuses on network traffic and application logs, not on the integrity of the firmware running on network devices. A backdoor in network infrastructure firmware is invisible to most conventional security tools: it does not appear in traffic analysis, does not create process anomalies visible to endpoint agents, and does not touch the file systems that most integrity monitoring covers. The emerging field of firmware security analysis - tools that extract and analyze firmware from network devices for integrity verification - was significantly motivated by the Juniper disclosure. Supply chain security review of network infrastructure became a standard practice at highly sensitive organizations after 2015.

The Broader NSA Cryptographic Influence Program

Dual EC DRBG was not the NSA's only cryptographic influence operation. The Snowden documents described a program called BULLRUN (NSA) / EDGEHILL (GCHQ) that aimed to "covertly influence" cryptographic standards, "introduce vulnerabilities" into commercial encryption products, and maintain "capabilities against TLS, SSH, and VPN." The program apparently operated at multiple levels: working within standards bodies to push weak or backdoored algorithms, working with vendors through classified agreements, and exploiting weaknesses in deployed implementations.

The scale and success of BULLRUN was never fully disclosed, and the Snowden documents relevant to it were not fully published. What was published was sufficient to create lasting uncertainty about which cryptographic standards could be trusted and which might be compromised. NIST's response - reopening reviews of multiple standards, publishing new guidelines explicitly rejecting NSA-influenced choices for random number generation - addressed the specific confirmed compromise but could not address the broader uncertainty.

The Juniper case added a recursive layer to this uncertainty: even if the NSA's original Dual EC backdoor was not being actively exploited after the 2013 exposure, a third party had used knowledge of the backdoor to insert their own access into deployed devices for seven years. The consequence of building cryptographic backdoors is that they become shared infrastructure once the knowledge of their existence spreads beyond the creator.

[IOC]
NetScreen / ScreenOS indicators: Affected versions: ScreenOS 6.2.0r15 through 6.2.0r18, ScreenOS 6.3.0r12 through 6.3.0r20 (pre-patch). Backdoor password: "<<< %s(un='%s') = %u" entered at any username or password prompt provides root/admin access. Audit log evidence: the authentication bypass leaves distinctive log entries; successful logins using the hardcoded password appear in logs as successful admin sessions with a specific format difference from normal logins. VPN backdoor: passive decryption left no detectable artifacts - traffic capture is required. Remediation: upgrade to ScreenOS 6.2.0r19 or 6.3.0r21 or later, or migrate off NetScreen hardware to supported Juniper SRX series. Long-term: audit all network device firmware versions against vendor-confirmed builds; implement UEFI/firmware attestation where available; treat unverifiable network infrastructure as potentially compromised when handling high-sensitivity traffic.