Congress plans to question about two dozen federal agencies on whether they were using backdoored Juniper network security appliances.
In December, Juniper Networks said it had discovered unauthorized code added to ScreenOS, the operating system that runs on its NetScreen network firewalls. The rogue code, which remained undetected for two years or more, could have allowed remote attackers to gain administrative access to vulnerable devices or to decrypt VPN connections.
The U.S. House Committee on Oversight and Government Reform wants to determine the impact that this issue had on government organizations and how those organizations responded to the incident.
The committee sent letters on Jan. 21 to, the Departments of Defense, Health and Human Services, State, the Securities and Exchange Commission the Nuclear Regulatory Commission, NASA, the Social Security Administration, USAID and many other government agencies.
The letters ask the recipients to identify whether they used devices running the affected ScreenOS versions, to explain how they learned about the issues and whether they took any corrective actions before Juniper released patches and to specify when they applied the company's patches.
The organizations have only two weeks, until Feb. 4, to respond and deliver the appropriate documents, a tight time frame given that "the time period covered by this request is from January 1, 2009 to the present."
Determining whether any division of a government department or agency used a vulnerable Juniper appliance for any period of time might prove difficult, especially if accurate inventories haven't been kept. For example, last year, due to inaccurate inventory records, the Internal Revenue Service did not know whether 1,300 of its computers had been upgraded away from Windows XP, which was retired by Microsoft in April 2014.
Security researchers estimate that the VPN backdoor was introduced into ScreenOS in August 2012 and the administrative access one in late 2013. Juniper has yet to reveal who added the unauthorized code to ScreenOS and the incident is reportedly being investigated by the FBI.
It also remains to be seen whether the Committee on Oversight and Government Reform is only interested in this particular case or will make similar inquiries going forward. Intentional or unintentional backdoor-like vulnerabilities -- such as hidden administrative accounts with hard-coded, static passwords -- are frequently found in networking products from a variety of vendors, and some of them are likely used by government agencies.