[186442] in North American Network Operators' Group
Re: [CVE-2015-7755] Backdoor in Juniper/ScreenOS
daemon@ATHENA.MIT.EDU (A.L.M.Buxey@lboro.ac.uk)
Fri Dec 18 22:08:06 2015
X-Original-To: nanog@nanog.org
Date: Fri, 18 Dec 2015 14:09:29 +0000
From: A.L.M.Buxey@lboro.ac.uk
To: Karsten Thomann <karsten_thomann@linfre.de>
In-Reply-To: <2790549.8LFx1ecJs8@linne>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
Hi,
> > Should we blame Juniper for letting a git repository open to
> > "unauthorized code" or should we congratulate them for their frankness
> > (few corporations would have admitted the problem)?
'un-authorized' - not authorized.
this could be code/idea by some/one engineer for eg debugging purpose etc that
just didnt get ANY signoff by anyone - so during code review they've questioned
its presence and not found the relevant sign-off etc.
take VW here...they are now blaming a small set of engineers who rigged the emissions
system....if they can say that no managers/execs knew about this and it was purely in
some small code team etc then that too is unauthorized code - but its internal,
not an external bad guy (it will be interesting however, in that case, whether that really
was the case and it WASNT known about by someone else...thus 'authorized' in that it wasnt
stopped)
alan
