Backdoor in OpenBSD’s IPSEC stack?

This following is the email exchange between Theo de Raadt and Gregory Perry. Theo is the lead coder of OpenBSD, and Gregory was a former contributor to the project.

This segment is Theo’s alarm to the community:

I have received a mail regarding the early development of the OpenBSD IPSEC stack. It is alleged that some ex-developers (and the company they worked for) accepted US government money to put backdoors into our network stack, in particular the IPSEC stack. Around 2000-2001.

Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products. Over 10 years, the IPSEC code has gone through many changes and fixes, so it is unclear what the true impact of these allegations are.

The mail came in privately from a person I have not talked to for nearly 10 years. I refuse to become part of such a conspiracy, and will not be talking to Gregory Perry about this. Therefore I am making it public so that
(a) those who use the code can audit it for these problems,
(b) those that are angry at the story can take other actions,
(c) if it is not true, those who are being accused can defend themselves.

Of course I don’t like it when my private mail is forwarded. However the “little ethic” of a private mail being forwarded is much smaller than the “big ethic” of government paying companies to pay open source developers (a member of a community-of-friends) to insert privacy-invading holes in software.

This segment is Gregory email to Theo:

Hello Theo,

Long time no talk. If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework. At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing technologies.

My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI. Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC.

This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn’t want to create any derivative products based upon the same.

This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments.

Merry Christmas…

Editor’s note: This is all scary stuff, but is it true? If you have any reason to question Gregory’s story (I do not), why do you think he will make stuff like this up? Should we be worried about the Linux kernel? SELinux?

Related Posts

How to write the first for loop in R In this tutorial we will have a look at how you can write a basic for loop in R. It is aimed at beginners, and if you’re not yet familiar with the bas...
Slate 21: HP’s Android-powered All-in-One computer First came the Slate 7, HP's Android-powered tablet computer. Now HP is about to release a 21.5 inch sibling - the Slate 21. This was what I hoped tha...
LibreOffice Portable, a Full-Featured Office Suite For USB, Removable and Cloud Drives PortableApps.com and The Document Foundation are proud to announce the immediate availability of LibreOffice Portable 3.3, a portable version of the f...
Green500 List top 10 are all powered by NVIDIA Tesla GPUs and Linux The November 2013 edition of the Green500 List has be released, just two days after the TOP500 List. Unlike the TOP500 List, which lists 500 of th...
CYOD, BYOD In the CYOD world, users are given a choice between several, purposefully selected Operating Systems. Depending on the environment, iOS and Android ar...
Windows 8.1 partitions on the Lenovo G50 AMD A8 laptop My old laptop finally packed up about a week ago, so I went shopping for a new one. With money tight, I naturally went for a bottom of the line uni...

We Recommend These Vendors and Free Offers

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).

Want to become an expert ethical hacker and penetration tester? Request your free video training course of Online Penetration Testing and Ethical Hacking

Whether you're new to Linux or are a Linux guru, you can learn a lot more about the Linux kernel by requesting your free ebook of Linux Kernel In A Nutshell.


2 Comments

  1. “Should we be worried about the Linux kernel? SELinux?”

    I hope not…

    But seriously… this (dictatorship-)government in america is still getting away with this crap?

    Wouldn’t surprise me if google, facebook, microsoft and others are backed by the NSA/CIA/FBI with countless backdoors… the fact is, if its american… don’t use it. All they want is your DNA, internet handles, passports and whatnot so they can dictate your life and own your personal dox. If you don’t agree or try to show the world what their dictatorship is doing then you get coined a rapist/terrorist.

    Now lets just wait for an interpol arrest warrant for this “Gregory” to be extradited to Sweden on sex charges…. -_-

  2. Pingback: Tweets that mention Backdoor in OpenBSD’s IPSEC stack? -- Topsy.com

Leave a Comment

Your email address will not be published. Required fields are marked *

*