If they hadn't already published it, why not? It could have done some good before, but does no good now.
https://search.edwardsnowden.com/ https://search.wikileaks.org
what more you have?
It's quite likely that Juniper's security advisory was sufficient cause to release this from the cache.
I must be naive in thinking that you just don't have a billionaire fund an organization to leak secrets in any timely fashion ;)
My guess is that there are a lot of documents to go through, which will take years.
Are you advocating for a Wikileaks-style unreducted data dump (against Snowdens wishes), or you want Greenwald to "work faster"?
edit: First picture here: http://boingboing.net/2015/12/21/juniper-networks-backdoor-c...
It does? Sounds like this is a rather normal, expected, analysis. They're just reviewing products; probably they already had similar capabilities on IOS and wanted to make sure they could handle other targets or a shift in the market. This does not sound like getting backdoors placed, at all.
I hate to be suspicious or cynical here, but is this just The Intercept being opportunistic? Is there any reason to relate this to the recent "unauthorized code" issues?
The timing of this article is obviously done in order to capitalize on the recent Juniper news. I would suspect all security agencies to be looking at the security of al networking products that they can get a hand on.
I am not so sure. There are strong indications pointing[1] at state actors.
[1] http://securityaffairs.co/wordpress/42971/hacking/juniper-sc...
> The vast majority of current Juniper exploits are against firewalls running the ScreenOS operating system.
This reads like a statement of fact. That they knew of multiple exploits against ScreenOS. Enough to use the term "vast majority". That doesn't mean the most recent backdoors are their work, but it does seem to imply that they found ways to penetrate NetScreen.
If that fails, let's hate on Juniper. In any case, the linked PDF says that they do indeed have current exploitation capabilities for Juniper products and are working on more, even if it initially reads like a product brochure.
How did Google engineers put it? Oh yeah:
https://plus.google.com/108799184931623330498/posts/SfYy8xbD...
It'd be surprising if NSA and GCHQ didn't have similarly powerful capabilities against all the current VPN products.
Don't forget that the newer SRX-series VPN gateways are JunOS-based, and seem to be recommended by most Juniper sales people these days. There are certainly a ton of ScreenOS devices, but Juniper seems to have mostly deprecated them in their messaging.
The primary Juniper security track certifications are JunOS-focused, and there's only a basic specialization available from them for ScreenOS. Juniper has mostly staked their future on JunOS from what I can tell.
So the bottom-line is that it comes down to how much you trust the people that made the software. Is it a very high quality vendor? Is it a very high quality open-source project?
The nice thing about open-source software is that you have a much better ability to evaluate this from the inside. Get on mailing lists, poke around trackers, and see how they usually deal with security disclosures. Do they even have a formal program to do so? I'm not sure that OpenVPN does, although a lot of distros watch that carefully.
No infiltration required.
This would be much easier than compromising specific algorithms or KE protocols. Cheap, too. All it takes is plenty of patience.
All software has defects, and if bugs entitled customers to civil damages there would be 0 technology companies left alive. The standard is negligence, but the NSA is sophisticated enough to compromise designs that were not negligent.
> "As we’ve stated previously … it is against established Juniper policy to intentionally include ‘backdoors’ that would potentially compromise our products or put our customers at risk. Moreover, it is Juniper policy not to work with others to introduce vulnerabilities into our products.”
-- Juniper
http://blog.cryptographyengineering.com/2015/12/on-juniper-b...
Another side of this coin is that they'll add to their hitlist whatever they encounter the most. They probably run into Juniper firewalls all the time. So, it's higher priority. Using high-quality, but lower-priority-to-them, components reduces you risk of being hit by them. So, one of my recommendations is to build/use strong systems, use diverse components of good quality, and obscure the workings of both at the interface. They'll trip your alarms trying to figure out what you're using before they hack you.
There was only one Snowden cache. If the document was provided by Snowden, did we hear about it earlier?
Who has access to the Snowden cache now? Do we know?
