I couldn’t tweet a better description than the headline for this piece: After SolarWinds breach, lawmakers ask NSA for help in cracking Juniper cold case.

For those who haven’t heard this story, the context here is back in 2015 hackers broke into the source code repository of Juniper’s NetScreen firewalls and introduced serious vulnerabilities. 1/
Everyone has heard of the SolarWinds supply chain attack, but almost nobody outside our little community remembers Juniper. We don’t even know who the ultimate victim was. And there’s a reason for that. 2/
The reason is simple: following the Juniper hack, the FBI and Juniper put a tight lid on everything. Nobody, including members of Congress, were able to get straight answers about who did it or what the target was. So it vanished from our collective memory. 3/
This has real consequences. To some extent our lack of preparedness for SolarWinds is a direct result of our government’s decision to pretend that the previous major supply-chain attacks didn’t happen. 4/
Why has the Juniper attack been buried by secrecy? There are two possible answers. One has to do with the nature of the hack, which very likely repurposed an existing backdoor in NetScreen firewalls. The other has to do with the ultimate target. 5/
Regarding the first, we know that Juniper included a *likely* crypto backdoor based on an NSA algorithm called Dual_EC_DRBG even before the hack. We also know that the attackers repurposed that code to use new public keys of their choosing. This is very embarrassing. 6/
(We know this because people on Twitter and co-authors of mine were able to reverse engineer the details from the published firmware images. See here for a nice explanation. https://t.co/CPHw8oA6zA)
The second answer to “why was this buried” is much more speculative. It has to do with the identity of the actual target(s) that were attacked using the NetScreen vulnerabilities. We don’t know who they are, and they might be important. 8/
I continue to harbor the conspiracy theory that the Office of Personnel Management hack was in some way related to Juniper, based solely on the timing and some equipment manifests from that agency. I’m probably wrong, but that would be a hell of a reason to cover things up. 9/
The point here is that with attacks like this and a secrecy response, we’re screwed. Until we know what happened in these cases, we can’t learn from it. This makes us defenseless, and you can bet our adversaries prefer it that way. 10/
It’s as though the US government decided to react to Pearl Harbor by covering things up. You have to imagine that history would look a lot different. Hopefully we’ll stop making this mistake. //fin

More from Law

@littlecarrotq I've been tracking these since December. Michigan


Wisconsin


Georgia


Arizona


Another Pennsylvania case. This is the most important one in my opinion. It shows the Republican Legislature broke the law when they created a mail-in ballot law in October, 2019, which they knew was against the state

You May Also Like

प्राचीन काल में गाधि नामक एक राजा थे।उनकी सत्यवती नाम की एक पुत्री थी।राजा गाधि ने अपनी पुत्री का विवाह महर्षि भृगु के पुत्र से करवा दिया।महर्षि भृगु इस विवाह से बहुत प्रसन्न हुए और उन्होने अपनी पुत्रवधु को आशीर्वाद देकर उसे कोई भी वर मांगने को कहा।


सत्यवती ने महर्षि भृगु से अपने तथा अपनी माता के लिए पुत्र का वरदान मांगा।ये जानकर महर्षि भृगु ने यज्ञ किया और तत्पश्चात सत्यवती और उसकी माता को अलग-अलग प्रकार के दो चरू (यज्ञ के लिए पकाया हुआ अन्न) दिए और कहा कि ऋतु स्नान के बाद तुम्हारी माता पुत्र की इच्छा लेकर पीपल का आलिंगन...

...करें और तुम भी पुत्र की इच्छा लेकर गूलर वृक्ष का आलिंगन करना। आलिंगन करने के बाद चरू का सेवन करना, इससे तुम दोनो को पुत्र प्राप्ति होगी।परंतु मां बेटी के चरू आपस में बदल जाते हैं और ये महर्षि भृगु अपनी दिव्य दृष्टि से देख लेते हैं।

भृगु ऋषि सत्यवती से कहते हैं,"पुत्री तुम्हारा और तुम्हारी माता ने एक दुसरे के चरू खा लिए हैं।इस कारण तुम्हारा पुत्र ब्राह्मण होते हुए भी क्षत्रिय सा आचरण करेगा और तुम्हारी माता का पुत्र क्षत्रिय होकर भी ब्राह्मण सा आचरण करेगा।"
इस पर सत्यवती ने भृगु ऋषि से बड़ी विनती की।


सत्यवती ने कहा,"मुझे आशीर्वाद दें कि मेरा पुत्र ब्राह्मण सा ही आचरण करे।"तब महर्षि ने उसे ये आशीर्वाद दे दिया कि उसका पुत्र ब्राह्मण सा ही आचरण करेगा किन्तु उसका पौत्र क्षत्रियों सा व्यवहार करेगा। सत्यवती का एक पुत्र हुआ जिसका नाम जम्दाग्नि था जो सप्त ऋषियों में से एक हैं।
1/“What would need to be true for you to….X”

Why is this the most powerful question you can ask when attempting to reach an agreement with another human being or organization?

A thread, co-written by @deanmbrody:


2/ First, “X” could be lots of things. Examples: What would need to be true for you to

- “Feel it's in our best interest for me to be CMO"
- “Feel that we’re in a good place as a company”
- “Feel that we’re on the same page”
- “Feel that we both got what we wanted from this deal

3/ Normally, we aren’t that direct. Example from startup/VC land:

Founders leave VC meetings thinking that every VC will invest, but they rarely do.

Worse over, the founders don’t know what they need to do in order to be fundable.

4/ So why should you ask the magic Q?

To get clarity.

You want to know where you stand, and what it takes to get what you want in a way that also gets them what they want.

It also holds them (mentally) accountable once the thing they need becomes true.

5/ Staying in the context of soliciting investors, the question is “what would need to be true for you to want to invest (or partner with us on this journey, etc)?”

Multiple responses to this question are likely to deliver a positive result.