Massive Cybersecurity Breach, NSA Software Compromised

Looks like Hillary’s server isn’t the only threat to national security these days. A recent discovery suggests the National Security Agency (NSA) may have been using compromised software for as many as three years – potentially exposing sensitive information to foreign spies. 

NSA software has been blamed for the problem, with experts claiming that a defect originated from an encryption “back door” hidden within the code. This vulnerability was discovered in December when IT company Juniper Networks (which makes IT products for the government) reported unauthorized code in its ScreenOS program. 

“There’s a lot of very sketchy stuff here,” said cryptology expert Matthew Green. Green has been working furiously to reverse-engineer the code. 

Experts agree the code was altered intentionally. Juniper acknowledged that this alteration could give hackers the ability to infiltrate NSA files. Its like “stealing a master key to get into any government building,” said one government official. “It’s a very serious problem,” added Senator Ron Johnson (R-WI). “It affects everybody’s IT systems.” 

A foreign government is likely behind the software flaw. The ability to turn NSA’s code into a operable back door would require expert hacking abilities as well as the infrastructure to spy on encrypted traffic. “Very few people outside of nation states have both of those things,” said Green. 

“Once adversaries get into a network, they’re often able to move laterally,” explained former assistant secretary of Defense Paul Stockton. Juniper has relied on this particular software since 2013, meaning our enemies could have had years to steal national security secrets and design future attacks. 

This threat is particularly frustrating because it could have been avoided. Security experts say that hackers were likely aided by a glitch in the encryption algorithm that was planted there by the NSA. Some suspect the algorithms contained “hidden doors” that could be used for surveillance purposes. The documents leaked in 2013 by former NSA contractor Edward Snowden confirm these suspicions. 

“That pretty solidly pointed the finger at these algorithms having been tampered with or made vulnerable by the NSA,” Green said.

Juniper has since announced that it will no longer be relying on the NSA-developed encryption algorithm in question. This is a considerable blow to the NSA – an organization that in recent years has been viewed as a sort of standard-bearer in regards to security technology.

Meanwhile, the House Oversight Committee is leading an investigation into the suspicious defect. The committee’s main concern is that the “back door” has yet to be locked. Government agencies are busy scanning data to see what may have been hacked, but the months-long process is frustrating. They are “dragging their feet,” complained Rep. Will Hurd (R-TX) of the Oversight Committee. “If government systems have yet to be fixed, then adversaries could still be stealing sensitive information crucial to national security,” he wrote in the Wall Street Journal. “The Department of Homeland Security is furiously working to determine the extent to which the federal government used ScreenOS. But Congress still doesn’t know the basic details of the breach.”

Other lawmakers haven’t even heard about the breach. Federal agencies have until February 4th to respond to the Oversight Committee’s questions about the software flaw. When the response is received, the committee will determine whether or not to hold an open hearing on the issue. 

“This is certainly something that we’ve got to be aware of and see what comes to light,” said Johnson. No matter what Congress does, however, it can’t overcome the difficulty of tracking a hacker. Expert hackers are skilled enough to “hide their tracks and to clean up after themselves,” said Stockton. This means the software glitch could provide hackers with a virtually undetectable and persistent presence in NSA networks.