View Full Version : FBI Added Secret Backdoors to OpenBSD

December 15th, 2010, 14:41
Okay, this is potentially very big news that really needs all the exposure it can get. OpenBSD's Theo de Raadt has received an email in which it was revealed to him that ten years ago, the FBI paid several open source developers to implement hidden backdoors in OpenBSD's IPSEC stack. De Raadt decided to publish the email for all to see, so that the code in question can be reviewed. Insane stuff.

De Raadt received the email from Gregory Perry, currently the CEO of GoVirtual Education. Ten years ago, while he was CTO at NETSEC, Perry did some consulting work for the FBI's GSA Technical Support Center. Perry's NDA expired recently, and as such, he decided to contact De Raadt about what he had learned ten years ago.

"My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI," Perry details in the email, "Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC."

"This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments," he adds, "For example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments."

De Raadt takes these allegations very seriously, and wants the code to be audited as soon as possible. Since the IPSEC stack is already quite old, and the allegations are also old, the code has gone through several revisions and the like, but still, De Raadt wants it analysed.

"The mail came in privately from a person I have not talked to for nearly 10 years," he details, "I refuse to become part of such a conspiracy, and will not be talking to Gregory Perry about this. Therefore I am making it public so that (a) those who use the code can audit it for these problems, (b) those that are angry at the story can take other actions, (c) if it is not true, those who are being accused can defend themselves."

If this turns out to be true, you could wonder what else has been put in open source projects. Scary thought.


December 16th, 2010, 15:07
When they review the code they should look for


directives or maybe just grep for FBI.....lame joke

December 17th, 2010, 04:00
E.J. Hilbert, former Bureau special agent said on Twitter: For the record. "FBI never bd openBSD. FBI tests software for such things before use but does not build or deploy"

December 17th, 2010, 10:08
Muhaha, what a lol!
My cat says he never munches mice. He tests if they are eatable but does not hunt or kill
I wouldn't confess such a thing either (the backdoor not the mice!), but I guess the FBI makes things even worse when they deny something like that.
It's time for some exhaustive review, me thinks.

December 17th, 2010, 11:09
[Originally Posted by Darkelf;88606][...]
It's time for some exhaustive review, me thinks.


December 20th, 2010, 22:42
I wonder if these kinds of secret deals were involved in Stuxnet and windows... Interesting that even the open source environment may have been almost equally susceptible.

December 29th, 2010, 03:42
According to a silicon.fr news, the IPSEC stack have been audited and no backdoor has been found. Problem is... the article isn't citing it's source...does the Bureau have an sourcecode audit team ?

http://www.silicon.fr/openbsd-la-porte-derobee-du-fbi-est-restee-close-43517.html - (FR)

There is a phile on cryptome about that, but still no mention of the aformentioned audit

December 29th, 2010, 18:08
Good luck finding the truth.

The FBI has been fucking rogue over here for decades.

That article is far from complete.


December 31st, 2010, 16:25
explanation for newbies:
you can easily understand Don Wooma , if remember, how CIA hates FBI...

..CIA at least pays good enough..

December 31st, 2010, 19:07
In my personal experience, the FBI guys were usually much better dressed than the CIA guys.

Maybe that's the reason for envy.