Well this freaking sucks.

Turns out people are poisoning everything out there.

From: Gregory Perry
To: “deraadt@openbsd.org”
Subject: OpenBSD Crypto Framework
Thread-Topic: OpenBSD Crypto Framework
Thread-Index: AcuZjuF6cT4gcSmqQv+Fo3/+2m80eg==
Date: Sat, 11 Dec 2010 23:55:25 +0000
Message-ID: <8D3222F9EB68474DA381831A120B1023019AC034@mbx021-e2-nj-5.exch021.domain.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Content-Type: text/plain; charset=”iso-8859-1″
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status: RO

Hello Theo,

Long time no talk. If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework. At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing
technologies.

My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI. Jason
Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC.

This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn’t want to create any derivative products based upon the same.

This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments.

Merry Christmas…

Gregory Perry
Chief Executive Officer
GoVirtual Education

“VMware Training Products & Services”

540-645-6955 x111 (local)
866-354-7369 x111 (toll free)
540-931-9099 (mobile)
877-648-0555 (fax)

Honestly I don’t know what that means for people who want privacy. Basically trust no one, trust nothing..

And certainly don’t run OpenBSD in a VMWare environment.

This entry was posted in ipsec, OpenBSD, random updates by neozeed. Bookmark the permalink.
avatar

About neozeed

What is there to tell? I’ve loved UNIX like things since I was first exposed to QNX in highschool (we had the Unisys ICONS!), and spent the better time of my teenage years trying to get my own UNIX… I should have bought Coherent in retrospect.. Anyways latched onto Linux in 1992, and then got some old BSD admin books and have been hooked on the VAX BSD & other big/ancient things since…!

2 thoughts on “Well this freaking sucks.

  1. Wow. I hope Theo was still able to breath as he read this. And hope FBI won't chase Gregory for the revenge.

    Increasing complexity makes Open Source is not that Open. It's still Open, but in a sense of an Open Maze, or Labyrinth.

    Looking at the bloated Linux kernel I've realized that without any documentation the source itself doesn't help to understand how the things work. Only a limited number of a competent people can fix the bugs in the kernel and most of this people are full time employees in corporations. Which means they may be forced to follow any evil NDA possible.

  2. Yeah it's very ominous, much like encryption, people that REALLY understand this stuff are a slim handful…

    But I guess it goes to show that as things gain popularity and pose a 'security interest' people are watching…

    personally I've never liked all the insanely complicated systems, who really knows what the hell is going on in these Gigabytes of gigabytes of compiled code on any modern machine?

Leave a Reply

Your email address will not be published.

Notify me of followup comments via e-mail. You can also subscribe without commenting.