Re: [Full-disclosure] OpenBSD IPSEC has backdoor
> This is not make sense. Is you say: Theo is will never allow backdoor, > he is responsible, then is you say No one said this. If someone is determined and bright enough then it is possible they could place a vulnerability in the code. one can only audit for vulnerabilities they know about > "The code is audited and for all > you know any back door which was placed in this code has been found > and fixed." then is why there is never mention from OpenBSD long time > ago: "Is we find backdoor code in audit and fix" is that to me would > be responsible. Is you cannot have your sarmale and eat it too. What are you talking about??? the allegation here is that this happened 10 years ago. Do you really believe that no security issues or errors, which could later be identified as security issues, have been fixed in that time. Don't be stupid, the fact that these issues where most likely identified as human error as opposed to malicious intent is because this is an open source project built on trust > Something wrong with this is picture. If is this Theo responsible like > you is say, and he is find backdoor long ago, because he is > responsible, he should have is said long time ago As i have tried to make clear above. I said that this alleged issue could have been fixed, that does not infer that it was identified as a backdoor. I am not an OpenBSD developer so please read the following which puts across the point i am trying to make much more elegantly http://marc.info/?l=openbsd-tech&m=129237675106730&w=2 It should be mentioned that at this point this is still just an accusation and one that is becoming more and more uncredible[1][2] [1]http://blog.scottlowe.org/2010/12/14/allegations-regarding-fbi-involvement-with-openbsd/ [2]http://marc.info/?l=openbsd-tech&m=129244045916861&w=2 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
the exploit are in your ass motherfucker ! 2010/12/15 Nahuel Grisolia > Kingcope, Where is the exploit for this? :P > > regards, > -- > Nahuel Grisolia - C|EH > Information Security Consultant > Bonsai Information Security Project Leader > http://www.bonsai-sec.com/ > (+54-11) 4777-3107 > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
On Wed, Dec 15, 2010 at 9:19 AM, John Bond wrote: > What is wrong with this. The code is audited and for all you know any > back door which was placed in this code has been found and fixed. It > would be arrogant and irresponsible for Theo or anyone else to ignore > a claim of this nature, with the stance of we audit everything and > therefore an organisation with an almost unlimited budget couldn't > possibly of sneaked something into an extremely complicated code base > with out us noticing. > This is not make sense. Is you say: Theo is will never allow backdoor, he is responsible, then is you say "The code is audited and for all you know any back door which was placed in this code has been found and fixed." then is why there is never mention from OpenBSD long time ago: "Is we find backdoor code in audit and fix" is that to me would be responsible. Is you cannot have your sarmale and eat it too. A = Theo is responsible B = OpenBSD is audited C = Theo not know of backdoor Something wrong with this is picture. If is this Theo responsible like you is say, and he is find backdoor long ago, because he is responsible, he should have is said long time ago: "We is find backdooruski and we is fix it!" Otherwise 1) is this theory that OpenBSD is audited is wrong or 2) Theo is know of backdoor and in order is to save his skin is maybe 3) OpenBSD is never no audited like they is claim. Theo просто охватывает его Ass!!! jajajajajajaja ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
yeah kingc0pe strut your stuff! u da b0mb!!111 2010/12/15 Benji > Dont encourage that weasel. > > > On Wed, Dec 15, 2010 at 2:33 PM, Nahuel Grisolia wrote: > >> Kingcope, Where is the exploit for this? :P >> >> regards, >> -- >> Nahuel Grisolia - C|EH >> Information Security Consultant >> Bonsai Information Security Project Leader >> http://www.bonsai-sec.com/ >> (+54-11) 4777-3107 >> >> ___ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> > > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
Dont encourage that weasel. On Wed, Dec 15, 2010 at 2:33 PM, Nahuel Grisolia wrote: > Kingcope, Where is the exploit for this? :P > > regards, > -- > Nahuel Grisolia - C|EH > Information Security Consultant > Bonsai Information Security Project Leader > http://www.bonsai-sec.com/ > (+54-11) 4777-3107 > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
Kingcope, Where is the exploit for this? :P regards, -- Nahuel Grisolia - C|EH Information Security Consultant Bonsai Information Security Project Leader http://www.bonsai-sec.com/ (+54-11) 4777-3107 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
On 15 December 2010 01:35, musnt live wrote: > Original e-mail is from Theo DeRaadt > > Is my question: "Why is now Theo cower like rat." Is because his > stance from the beginning: "we is audit everything" for make me > believe Theo was is also on the payroll. Enjoy everyone. What is wrong with this. The code is audited and for all you know any back door which was placed in this code has been found and fixed. It would be arrogant and irresponsible for Theo or anyone else to ignore a claim of this nature, with the stance of we audit everything and therefore an organisation with an almost unlimited budget couldn't possibly of sneaked something into an extremely complicated code base with out us noticing. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
On 12/14/10 11:36 PM, musnt live wrote: > On Tue, Dec 14, 2010 at 9:29 PM, Graham Gower wrote: >> On 15 December 2010 12:05, musnt live wrote: >>> Original e-mail is from Theo DeRaadt >>> >>> Is my question: "Why is now Theo cower like rat." Is because his >>> stance from the beginning: "we is audit everything" for make me >>> believe Theo was is also on the payroll. Enjoy everyone. >> >> I have no idea what you're talking about here. Theo has always been >> pragmatic regards security. He could easily have ignored this mail, >> but decided to make it public in the spirit of full disclosure. >> >> It seems like a difficult task to flat out deny that a backdoor was >> inserted, given the circumstances. So he's probably just taking the >> opportunity to get more eyeballs on the code, which will be positive >> regardless of whether backdoor(s) are found. >> >> -Graham >> > > It is for no difficult task in this him to do so. By Theo disclosing > is this email he is take pre-emptive strike in this that the event for > if he no say anything this original author come forward and say: "I is > told you so, Theo is know all along" > > Is you no familiar with this is OpenBSD, OpenBSD is for too highly > audited code especially from Theo. You is cannot is have is this two > way: > > "We are ultra secure and we audit everysing including our babushka's panties" > > and > > "We is not know, for is to maybe we is should audit this now" It seems like you may be digging too deeply into this. Ultimately if it ended up being true you may be correct that he could use this to cover himself however to me he's being responsible disclosing this. I'm sure politics is in his mind however the ultimate concern is the potential scope of the issue if it turns out true. Full disclosure of the e-mail / concern is fully warranted and responsible in my eyes. Perhaps stick to the issue at hand instead of digging into ulterior motives - I find the actual issue itself more intriguing than Theo looking for an "out". -Cody ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
On Tue, Dec 14, 2010 at 9:29 PM, Graham Gower wrote: > On 15 December 2010 12:05, musnt live wrote: >> Original e-mail is from Theo DeRaadt >> >> Is my question: "Why is now Theo cower like rat." Is because his >> stance from the beginning: "we is audit everything" for make me >> believe Theo was is also on the payroll. Enjoy everyone. > > I have no idea what you're talking about here. Theo has always been > pragmatic regards security. He could easily have ignored this mail, > but decided to make it public in the spirit of full disclosure. > > It seems like a difficult task to flat out deny that a backdoor was > inserted, given the circumstances. So he's probably just taking the > opportunity to get more eyeballs on the code, which will be positive > regardless of whether backdoor(s) are found. > > -Graham > It is for no difficult task in this him to do so. By Theo disclosing is this email he is take pre-emptive strike in this that the event for if he no say anything this original author come forward and say: "I is told you so, Theo is know all along" Is you no familiar with this is OpenBSD, OpenBSD is for too highly audited code especially from Theo. You is cannot is have is this two way: "We are ultra secure and we audit everysing including our babushka's panties" and "We is not know, for is to maybe we is should audit this now" ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] OpenBSD IPSEC has backdoor
On 15 December 2010 12:05, musnt live wrote: > Original e-mail is from Theo DeRaadt > > Is my question: "Why is now Theo cower like rat." Is because his > stance from the beginning: "we is audit everything" for make me > believe Theo was is also on the payroll. Enjoy everyone. I have no idea what you're talking about here. Theo has always been pragmatic regards security. He could easily have ignored this mail, but decided to make it public in the spirit of full disclosure. It seems like a difficult task to flat out deny that a backdoor was inserted, given the circumstances. So he's probably just taking the opportunity to get more eyeballs on the code, which will be positive regardless of whether backdoor(s) are found. -Graham ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] OpenBSD IPSEC has backdoor
Original e-mail is from Theo DeRaadt Is my question: "Why is now Theo cower like rat." Is because his stance from the beginning: "we is audit everything" for make me believe Theo was is also on the payroll. Enjoy everyone. http://marc.info/?l=openbsd-tech&m=129236621626462&w=2 I have received a mail regarding the early development of the OpenBSD IPSEC stack. It is alleged that some ex-developers (and the company they worked for) accepted US government money to put backdoors into our network stack, in particular the IPSEC stack. Around 2000-2001. Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products. Over 10 years, the IPSEC code has gone through many changes and fixes, so it is unclear what the true impact of these allegations are. The mail came in privately from a person I have not talked to for nearly 10 years. I refuse to become part of such a conspiracy, and will not be talking to Gregory Perry about this. Therefore I am making it public so that (a) those who use the code can audit it for these problems, (b) those that are angry at the story can take other actions, (c) if it is not true, those who are being accused can defend themselves. Of course I don't like it when my private mail is forwarded. However the "little ethic" of a private mail being forwarded is much smaller than the "big ethic" of government paying companies to pay open source developers (a member of a community-of-friends) to insert privacy-invading holes in software. From: Gregory Perry To: "dera...@openbsd.org" Subject: OpenBSD Crypto Framework Thread-Topic: OpenBSD Crypto Framework Thread-Index: AcuZjuF6cT4gcSmqQv+Fo3/+2m80eg== Date: Sat, 11 Dec 2010 23:55:25 + Message-ID: <8d3222f9eb68474da381831a120b1023019ac...@mbx021-e2-nj-5.exch021.domain.local> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Status: RO Hello Theo, Long time no talk. If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework. At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing technologies. My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI. Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC. This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn't want to create any derivative products based upon the same. This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments. Merry Christmas... Gregory Perry Chief Executive Officer GoVirtual Education "VMware Training Products & Services" 540-645-6955 x111 (local) 866-354-7369 x111 (toll free) 540-931-9099 (mobile) 877-648-0555 (fax) http://www.facebook.com/GregoryVPerry http://www.facebook.com/GoVirtual ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
