Schneier on Security

David • January 7, 2014 6:46 PM

Not knowing much about Juniper, but having studied Cisco, I googled “Juniper firewall nvram” and had this link at phrack.org show up as the fifth hit. (Not endorsing the link, its validity, or its purpose…just a convenient example.)

So they follow pretty much the same general pattern I’ve seen in others–firmware loading the OS from a local flash/nvram, with configuration files alongside. More permanent storage probably holds the primary image–the fallback in case a sysadmin just wants to go back to start.

Just an educated guess, but they probably put most/all of the security on keeping unauthorized users from accessing the firewall–not keeping anyone who is actually in the system from doing things.

In my own mind, I refer to such systems as “crunchy”–hard outer shell, gooey soft interior. Sure, they are fast, cheap, and configurable, but way too trusting.

Modern desktop OSs have gone the way of trusting no one by default–if nothing else, you have to click the “Are you sure?” dialog when it trips one of the guards.

Detecting changes in these environments means you have to either add an internal audit–subject to corruption, also–or build in an external audit hook–which can be spoofed or used as an additional attack vector.

If I was designing a detection system, I would go the second route, to start with. Design a self-sufficient auditor that “knows” what the config and files should be, and routinely hooks into the remote boxes to check the data there. You still have the spoofing problem (“No spyware here, boss!”), but it’s better than just believing that the system is unhacked.

David • January 8, 2014 8:57 AM

@TinyLittleAnt,

I agree that you can’t (well, not according to the original design) have a trust-less internet, and that these and most routers were set up as single-purpose devices. The crunchiness I was referring to was the internal security of the router, not the way it performs its functions.

I can even support your point of why it’s this way. Computers, even single-purpose ones like routers, are flexible, and it makes perfect sense for a manufacturer to build the system in a way that’s easy to upgrade, simple to access, and still gives the level of security that was viewed as sufficient for the time.

But the NSA revelations have changed the environment. A single hacker is a threat, but mostly a nuisance; they do damage that has to be repaired, costing time and money and maybe reputation.

Criminal organizations and competitors are a bigger threat, but they usually have more specific goals–steal certain data and get away with it where it can be turned into money or advantage.

The NSA takes a completely different approach–gain access to a system, but leave everything functioning as-is. In a way, it’s kind of admirable. Rather than damaging or removing anything, they just want life to go on in a normal fashion while they watch. That is a different security issue than what has been emphasized up to now.

(Hell, if adware and botnet programmers took the same approach, they’d probably try to make computers run better so users wouldn’t complain about poor performance and start looking for the interloper…)

It’s this type of threat where my comments were directed–not redesigning the web or checking the validity of every single packet, but keeping the ninja-style hacks from happening. And, of course, it’s a trade-off: Single-purpose systems are faster; added security is added expense; replacing the all of the current systems is prohibitively expensive and complicated; choosing a security design that works is better than throwing in the flavor-of-the-month fix.

Hope this clarifies. I agree with all of your points, but I think there is a way to do things better–you just have to direct your efforts in the right way.