Category Archives: Failed foreign policy

U.S. Soldiers not Allowed to Fight, Turns Deadly A’stan

Posted on by

Afghanistan is falling to the Taliban and ISIS has mobilized operating cells in the region.

In part NYT’s: OPERATING BASE FENTY, Afghanistan — The Islamic State is establishing “little nests” in Afghanistan, adding to the complex array of threats confronting Afghan forces and their international partners as they try to reverse a serious decline in security, Defense Secretary Ashton B. Carter said Friday. Mr. Carter was visiting this base in eastern Afghanistan, where he conferred with Gen. John F. Campbell, the American commander of the international coalition that is supporting Afghan forces, and Mohammad Masoom Stanekzai, the acting Afghan defense minister.


General Campbell painted a sobering picture of the fighting ahead, though he said the American military was trying to help the Afghan forces adapt so that they could limit their casualties.
“We just went through a very tough fighting season,” General Campbell told reporters traveling with Mr. Carter. “We don’t even talk in terms of fighting seasons anymore because it is kind of continuous fighting.”

6 US Troops Killed in Afghanistan Suicide Bombing, Official Says

A view of Bagram Airfield, Afghanistan from the Air Traffic Control Tower's catwalk after a recent rainstorm. (U.S. Air Force photo by Staff Sgt. Craig Seals)

Military.com: A suicide bombing near Bagram Airfield in Afghanistan killed six U.S. troops and wounded two other Americans and an interpreter, a senior U.S. defense official confirms to Fox News.

The Taliban claimed responsibility for the bombing, which was the largest attack on foreign troops in Afghanistan since August.

It happened at around 1.30 p.m. local time in the vicinity of Bagram, the largest U.S. military facility in Afghanistan, according to U.S. Army Brig. Gen William Shoffner.

Mohammad Asim Asim, governor of Parwan province, where Bagram is located, said the bomber rammed an explosives-laden motorcycle into a combined NATO-Afghan foot patrol as it moved through a village close to the base, which is 28 miles north of Kabul.

It is the first major attack on a NATO military convoy since August 22, when three American contractors with the RS base were killed in a suicide attack on their convoy in Kabul. On August 7 and 8, Kabul was the scene of three insurgent attacks within 24 hours that left at least 35 people dead. One of the attacks, on a U.S. special operations forces base outside Kabul left one U.S soldier and eight Afghan civilian contractors dead.

Monday’s attack came as Taliban gunmen and government forces battled for control of a strategic district in the southern province of Helmand after it was overrun by Taliban insurgents, delivering a serious blow to government forces.

Mohammad Jan Rasulyar, Helmand’s deputy governor, said insurgents took control of Sangin district on Sunday. Only Afghan army facilities in the district had not been taken by the insurgents, he said. Casualties among Afghan security forces were high, he added, though he gave no figures.

Afghan Army commandoes and special forces had arrived in Sangin to push a counter-offensive, the Defense Ministry spokesman, Dawlat Waziri, said. He told reporters the Afghan air force had conducted 160 combat and transport flights over Sangin in the past 48 hours.

Among the insurgent forces in Helmand, “three out of 10 are foreign fighters,” he said, adding that they included Pakistanis, Chechens, Uzbeks, Arabs and Chinese Uighurs. “The presence of the foreigners in this imposed war complicates the sitaution in Helmand,” he said, echoing the government line that the war is run by a Taliban leadership believed to be based in Pakistan with official protection.

Helmand is an important Taliban base as it produces most of the world’s opium, a crop that helps fund the insurgency.

Sangin district has bounced in and out of Taliban control for some years, and fighting there has produced high casualties among both Afghan and international forces. British forces in particular saw intensive fighting there at the height of the war in 2006 and 2007. Britain lost more than 450 troops during its combat mission in Afghanistan, more than 100 of them in Sangin.

Helmand’s deputy governor Rasulyar on Sunday took the unusual step of using his Facebook page to warn President Ashraf Ghani that the entire province of Helmand was in danger of falling to the insurgents if central authorities failed to send help.

In Helmand, more than 90 members of the Afghan security forces died fighting in the two days before his Facebook plea, with hundreds killed in the past six months, he said in his open letter to Ghani.

The head of Helmand’s provincial council, Muhammad Kareem Atal, said that 28 members of the Afghan security forces — usually a reference to army and police who also fight on the front lines across the country — were killed fighting on Sunday. Another 15 were critically wounded, he said.

“Around 65 percent of Helmand is now under Taliban control,” Atal said. “In every district either we are stepping back or we are handing territory over to Taliban, but still, until now, no serious action has been taken,” he said, echoing Rasulyar’s plea to the central authorities for help.

Important districts across Helmand province, including Nad Ali, Kajaki, Musa Qala, Naw Zad, Gereshk and Garmser, have all been threatened by Taliban takeover in recent months. Insurgents are also believed to be dug in on the outskirts of the provincial capital, Lashkar Gah.

Taliban fighters, sometimes working with other insurgent groups like the Islamic Movement of Uzbekistan, have managed to overrun many districts across the country this year, as well as staging a three-day takeover of the major northern city of Kunduz. They rarely hold territory for more than a few hours or days, but the impact on the morale of Afghan forces is substantial.

Atal said more than 2,000 members of the security forces had been killed fighting in Helmand in 2015.

He said a major reason “that our forces are losing” was that many soldiers and police were deserting their posts in the face of the Taliban onslaught.

“There is a big difference between the number of both soldiers and police recorded as on duty, and the real number,” he said, saying the official record was stuffed with “ghost police and soldiers.”

The Taliban insurgency has spread across the country this year, following the withdrawal of international combat forces at the end of 2014. This has stretched government resources thin, as the traditional winter lull in fighting has so far failed to take place in the warmer, southern provinces.

The war has intensified since the announcement in late July that the founder and leader of the Taliban, Mullah Mohammad Omar, had been dead for more than two years. His deputy, Mullah Akhtar Mansoor, succeeded him, causing internal ructions and delaying the likelihood that a peace dialogue with the Afghan government, halted after the announcement of Mullah Omar’s death, will restart in the foreseeable future.

The Pentagon released a report last week warning that the security situation in Afghanistan would deteriorate as a “resilient Taliban-led insurgency remains an enduring threat to U.S., coalition, and Afghan forces, as well as to the Afghan people.”

The U.S. now has about 9,800 troops in Afghanistan, some of which are involved in counterterrorism missions. With NATO contributions, there are about 13,000 foreign troops in Afghanistan.

Iran Swapping Nuclear Material with Russia

Posted on by

Sheesh, what could go wrong and what uranium and why to Russia?

In part from FreeBeacon: Russia and Iran are beginning to trade sensitive nuclear materials, an activity that is at least in part condoned by the Obama administration and permissible under the tenets of the recent nuclear accord, according to U.S. and Iranian officials.

Russian-made yellow cake, a type of uranium powder that helps turn it into a nuclear fuel, “is in Iran and Iran’s enriched uranium cargo will be sent to Russia” within the next several days, according to top Iranian officials quoted this week in the country’s state-run press.

Senior U.S. officials confirmed on Thursday that the Obama administration backs the opening of commercial nuclear trade between Moscow and Tehran.

“Commercial contracts are in place for Iran to ship its enriched uranium stockpiles to Russia,” Stephen Mull, a State Department official who is leading the administration’s charge to implement the nuclear deal, told lawmakers. More details here.

This condition is quite familiar especially with regard to Iran.

Bishkek (AKIpress) – nuke plant Russia and Kazakhstan are preparing an intergovernmental agreement on construction of a nuclear power plant, Presidential aide Yuri Ushakov told TASS on Friday.

“An intergovernmental cooperation agreement is being prepared for construction of a Russia-designed nuclear power plant within the territory of Kazakhstan,” he said, adding that the issue may be touched upon on December 21 at the meeting of presidents of Russia and Kazakhstan “on the sidelines” of the CSTO (Collective Security Treaty Organization) and the SEEC (Supreme Eurasian Economic Council) summit.

“The leaders of the two countries are expected to dwell upon the problem of boosting trade and economic cooperation,” Ushakov said.

Then there is India:

BusinessInsider: India is expected to offer Russia land in Andhra Pradesh to set up units five and six of Kudankulam nuclear power plant. This is in line with the ‘Make in India‘ initiative. The decision would be finalised during Prime Minister Narendra Modi‘s visit to Moscow this week.

“We will follow principles of ‘localisation’ as per Make in India initiative for setting up Kudankulam nuclear power plant five and six,” sources told PTI.

Russia is working a deal in Jordan but back to Iran:

Back in 2013-14: WASHINGTON — Russia has agreed to build Iran two additional nuclear power plants, Iran’s state-run Press TV announced on Wednesday.

Russia will construct the new facilities next to Iran’s sole existing nuclear power plant in the city of Bushehr.

That plant was also built with Russian assistance, and was fueled for operation in 2011. The reactor was put under full Iranian control in 2013.

The deal includes two desalination plants and is reportedly in exchange for oil; Russia built first and only reactor at Bushehr.

Iran To Ship Enriched Uranium To Russia

 RFEL: Iranian nuclear officials say Tehran will export most of its enriched uranium stockpile to Russia in the coming days as it implements a nuclear deal to secure relief from international sanctions.

The Iranian news agency IRNA quotes nuclear chief Ali Akbar Salehi as saying on December 19 that “around nine tons of Iran’s enriched uranium will be exported to Russia.”

That is roughly the amount that Iran must export to bring its stockpile down to the required level under the sanctions-relief deal.

Salehi did not give a precise timetable for what he meant by “in the coming days.”

Under the terms of the deal it reached in July with world powers, Iran must reduce its stockpile of enriched uranium to around 300 kilograms. It must also deactivate and store most of its centrifuges, and remove the core of a heavy water reactor in Arak so it cannot be used to produce plutonium.

On December 16, Tehran said it was working to complete the requirements in the next two to three weeks, after the International Atomic Energy Agency (IAEA) closed its investigation of Iran’s past nuclear activities.

The 35-nation governing board of the IAEA passed a resolution on December 15 ending the UN nuclear watchdog agency’s 12-year-long inquiry into suspicions of “possible military dimensions” to Iran’s nuclear work.

IAEA chief Yukiya Amano said afterward that Tehran has taken the necessary steps to cooperate with the agency and that it was “not impossible” that sanctions could be lifted in January.

Iran has shown a strong apparent desire in recent weeks to build on the momentum of the nuclear deal and restore international economic links after years of sanctions.

Iranian Industry Minister Mohammad Reza Nematzadeh said on December 17 that Tehran is prepared to begin negotiations for membership in the World Trade Organization (WTO).

Iran first applied for WTO membership in July 1996, but progress had been minimal since then due to tensions over the Iranian nuclear crisis.

Iran Behind the Bombing of the Jews in Argentina

Posted on by

In Secret Recordings, Former Argentine FM Admits Iran Behind Massive 1994 Terror Attack

TheTower: Former Argentine Foreign Minister Héctor Timerman knew that Iran was responsible for the 1994 bombing of the AMIA Jewish center in Buenos Aires even as he negotiated with the regime in Tehran, secretly-recorded telephone conversations released on Friday reveal.

The previously unknown recordings of conversations between Timerman and leaders of the Argentine Jewish community confirm what has long been suspected. While negotiating the infamous “Memorandum of Understanding” in 2013 aimed at setting up a joint commission with Iran to supposedly investigate the bombing, Timerman had no doubt that Tehran was behind the atrocity that claimed the lives of 85 people and injured hundreds more.

The conversations took place in 2012. In the first recording, Timerman is speaking with Guillermo Borger, the then president of the AMIA Jewish community organization. He attempts to persuade Borger to support the negotiations with Iran that would in due course lead to the signing of the Memorandum.

Borger: We don’t regard Iran as valid [as a negotiating partner].

Timerman: And who do you want me to negotiate with, Switzerland?

Borger: I will just say that Iran lies, is not credible and denies the Holocaust.

Timerman: But we don’t have anyone else to negotiate with […] Well, tell me who you want me to negotiate with?

Borger: I understand, I wish there was someone else to negotiate with.

Timerman: If there was someone else, they [the Iranians] wouldn’t have planted the bomb. So we are back to the beginning. Do you have someone else for me to negotiate with?

The second conversation is between Timerman and José Scaliter, the Vice President of the AMIA at the time:

Timerman: Eighteen years ago they [the Iranians] planted the bomb. You don’t tell me who I should negotiate with, you tell me who I shouldn’t negotiate with. What a smartass you are, so who do you want me to negotiate with?

Scaliter: The Prosecutor [Alberto Nisman, found dead in suspicious circumstances in January 2015] working on this case, who wasn’t appointed by us, carried out a serious and important investigation and says Iran did it.

Timerman: Great! Fantastic! So how do you want me to bring them [the Iranian fugitives to Argentina]. You never know what should be done.

It’s not clear who made the recordings or why they were leaked just now. Timerman himself just made a sudden reappearance on Twitter to complain that they were made in secret by Borger and that indeed seems the likeliest explanation. (Timerman did not, notably, claim that the recordings were fake, or that they distorted his views.) By the sound of the recordings, it seems that Borger and Scaliter simply put Timerman on the speaker in their office and recorded the conversations without mentioning that they were doing so.

Considering the track record of the previous government of President Cristina Fernández de Kirchner, whom Timerman served, in publicly hounding those who crossed it, Borger and Scaliter may have wished to have a guarantee that their conversation was recorded faithfully. The recent election of Mauricio Macri as President, a completely unexpected outcome for Fernández de Kirchner and her allies, may have emboldened the AMIA leaders to leak the recordings now.

There may be others with secrets to reveal, now that they can do so without harassment from Fernández de Kirchner’s government. The mother of Alberto Nisman, the late federal prosecutor investigating the AMIA bombing, told a journalist in recent days that she has a digital copy of “all” of her son’s formal complaint against Timerman and Fernández de Kirchner over their deal with Iran, along with “all” the evidence he collected to support it.

It’s not clear whether Nisman, who was found dead in January 2015 hours before he was to present his complaint, would have had access to the recordings. As Scaliter pointed out in his conversation with Timerman, Nisman was working for the government and not AMIA, and in any case had access to other sources of information about the negotiations with Iran.

The revelation of these recordings confirms Nisman’s thesis that the Memorandum was a sham, designed to protect those guilty of the AMIA Massacre. The Argentine government, despite knowing that Iran’s responsibility was beyond doubt, agreed to let the murderers “investigate” themselves through an Orwellian “Truth Commission,” and led Iran to believe that simply signing the Memorandum would lead to Interpol dropping the arrest warrants against its citizens, which seems to have been Tehran’s initial if not principal motivation in negotiating the pact. As a result, trade relations between the two countries would flourish, allowing enormous sums to be made by Argentine officials in state-body-to-state-body deals free from market pressures or scrutiny, the preferred kirchnerista business model. Elsewhere on the recordings, Timerman speaks of the negotiations being a “great opportunity for Argentina.” It’s not difficult to imagine what kind of opportunity he had in mind and which Argentines he thought might benefit.

Every word spoken by the former Argentine government and its supporters in defense of the Memorandum has now been proven to be a lie – not that there was ever much doubt about that. As soon as her husband and predecessor Nestor Kirchner died in October 2010, Cristina Fernández de Kirchner could not wait to launch negotiations with Iran, hoping to bury the AMIA issue once and for all.

And the worst of it is that none of this should come as a shock. Shortly after Timerman’s appointment as Foreign Minister in 2010, I wrote this satire on his complaisant attitude to the Iranians on a blog sponsored by the American Jewish Committee. Looking back, it’s clear that Cristina Fernández de Kirchner’s handling of the AMIA case was, in fact, far worse than I imagined it was going to be. Deeper details on the Iranian mission to kill Jews in Argentina.

Forget the EMP, It’s the Hack, You’re at Risk

Posted on by

Iranian hackers infiltrated computers of small dam in NY

WASHINGTON (Reuters) – Iranian hackers breached the control system of a dam near New York City in 2013, an infiltration that raised concerns about the security of the country’s infrastructure, the Wall Street Journal reported on Monday, citing former and current U.S. officials.

Two people familiar with the breach told the newspaper it occurred at the Bowman Avenue Dam in Rye, New York. The small structure about 20 miles from New York City is used for flood control.

The hackers gained access to the dam through a cellular modem, the Journal said, citing an unclassified Department of Homeland Security summary of the incident that did not specify the type of infrastructure.

The dam is a 20-foot-tall concrete slab across Blind Brook, about five miles from Long Island Sound.

“It’s very, very small,” Rye City Manager Marcus Serrano told the newspaper. He said FBI agents visited in 2013 to ask the city’s information-technology manager about a hacking incident.

The dam breach was difficult to pin down, and federal investigators at first thought the target was a much larger dam in Oregon, the Journal said.

The breach came as hackers linked to the Iranian government were attacking U.S. bank websites after American spies damaged an Iranian nuclear facility with the Stuxnet computer worm.

It illustrated concerns about many of the old computers controlling industrial systems, and the White House was notified of the infiltration, the Journal said.

The newspaper said the United States had more than 57,000 industrial control systems connected to the Internet, citing Shodan, a search engine that catalogs each machine.

Homeland Security spokesman S.Y. Lee would not confirm the breach to Reuters. He said the department’s 24-hour cybersecurity information-sharing hub and an emergency response team coordinate responses to threats to and vulnerabilities in critical infrastructure.

***

Cant Sleep, You are at Risk

In part from Wired: If you want to keep yourself up at night, spend some time reading about the latest developments in cybersecurity. Airplanes hacked, cars hacked, vulnerabilities in a breathtaking range of sensitive equipment from TSA locks to voting booths to medical devices.

The big picture is even scarier. Former NSA Director Mike McConnell suspects China has hacked “every major corporation” in the US. Edward Snowden’s NSA leaks revealed the US government has its own national and international hacking to account for. And the Ponemon Institute says 110 million Americans saw their identities compromised in 2014. That’s one in two American adults.

The system is broken. It isn’t keeping us, our companies, or our government safe. Worse yet, no one seems to know how to fix it.

How Did We Get Here?

One deceptive truth seems to drive much of the cybersecurity industry down a rabbit hole: If you keep bad actors and bad software out of your system, you have nothing to worry about.

Malicious actors target “endpoints”—any device or sensor connected to a network—to break into that network. Network security seeks to protect those endpoints with firewalls, certificates, passwords, and the like, creating a secure perimeter to keep the whole system safe.

This wasn’t difficult in the early days of the Internet and online threats. But today, most private networks have far too many endpoints to properly secure. In an age of “Bring Your Own Device,” the cloud, remote access, and the Internet of Things, there are too many vulnerabilities hackers can exploit. As Ajay Arora, CEO of file security company Vera, notes, there is no perimeter anymore. It’s a dream of the past.

But the security paradigm remains focused on perimeter defense because, frankly, no one knows what else to do. To address threats, security experts should assume compromise – that hackers and malware already have breached their defenses, or soon will – and instead classify and mitigate threats.

The CIA Triad

The information security community has a model to assess and respond to threats, at least as a starting point. It breaks information security into three essential components: confidentiality, integrity, and availability.

Confidentiality means protecting and keeping your secrets. Espionage and data theft are threats to confidentiality.

Availability means keeping your services running, and giving administrators access to key networks and controls. Denial of service and data deletion attacks threaten availability.

Integrity means assessing whether the software and critical data within your networks and systems are compromised with malicious or unauthorized code or bugs. Viruses and malware compromise the integrity of the systems they infect.

The Biggest Threat

Of these, integrity is the least understood and most nebulous. And what many people don’t realize is it’s the greatest threat to businesses and governments today.

Meanwhile, the cybersecurity industry remains overwhelmingly focused on confidentiality. Its mantra is “encrypt everything.” This is noble, and essential to good security. But without integrity protection, the keys that protect encrypted data are themselves vulnerable to malicious alteration. This is true even of authenticated encryption algorithms like AES-GCM.

In the bigger picture, as cybercrime evolves, it will become clear that loss of integrity is a bigger danger than loss of confidentiality. One merely has to compare different kinds of breaches to see the truth of this:

A confidentiality breach in your car means someone learns your driving habits. An integrity breach means they could take over your brakes. In a power grid, a confidentiality breach exposes system operating information. An integrity breach would compromise critical systems, risking failure or shutdown. And a confidentiality breach in the military would mean hackers could obtain data about sensitive systems. If they made an integrity beach, they could gain control over these weapons systems. Full details and actions you can take to protect yourself, go here.

Juniper Hacked, Several Govt Agencies at Risk

Posted on by

Backdoor Code Found in Firewall

Engadget: One of the reasons corporate users and the privacy-minded rely on VPNs is to control access to their networks and (hopefully) not expose secrets over insecure connections. Today Juniper Networks revealed that some of its products may not have been living up to that standard, after discovering “unauthorized code” in the software that runs on its NetScreen firewalls during a code review. Pointed out by security researcher “The Grugq,” the backdoor has been present since late 2012 and can only be fixed by upgrading to a new version of software just released today.

Telnet / ssh exposes a backdoor added by attackers to ScreenOS source code. This has been there since August 2012. Noted code here.

The pair of issues that created the backdoor would allow anyone who knows about it to remotely log in to the firewall as an administrator, decrypt and spy on supposedly secure traffic, and then remove any trace of their activity. Obviously this is a Very Bad Thing, although Juniper claims it has not heard of any exploitation in the wild (which would be difficult, since no one knew it existed and attackers could hide their traces) so far.

Beyond sending IT people sprinting to patch and test their setups, now we can all speculate about which friendly group of state-sponsored attackers is responsible. US government officials have recently been pushing for mandated backdoor access to secure networks and services, but the Edward Snowden saga made clear that even our own country’s personnel aren’t always going to ask permission before snooping on any information they want to check out. I contacted Juniper Networks regarding the issue, but have not received a response at this time.

Update: A Juniper Networks spokesperson told us:

During a recent internal code review, Juniper discovered unauthorized code in ScreenOS® that could allow a knowledgeable attacker to gain administrative access and if they could monitor VPN traffic to decrypt that traffic. Once we identified these vulnerabilities, we launched an investigation and worked to develop and issue patched releases for the impacted devices. We also reached out to affected customers, strongly recommending that they update their systems and apply the patched releases with the highest priority.

The patched releases also address an SSH bug in ScreenOS that could allow an attacker to conduct DoS attacks against ScreenOS devices. These two issues are independent of each other.

Newly discovered hack has U.S. fearing foreign infiltration

Washington (CNN) A major breach at computer network company Juniper Networks has U.S. officials worried that hackers working for a foreign government were able to spy on the encrypted communications of the U.S. government and private companies for the past three years.

The FBI is investigating the breach, which involved hackers installing a back door on computer equipment, U.S. officials told CNN. Juniper disclosed the issue Thursday along with an emergency security patch that it urged customers to use to update their systems “with the highest priority.”

The concern, U.S. officials said, is that sophisticated hackers who compromised the equipment could use their access to get into any company or government agency that used it.

One U.S. official described it as akin to “stealing a master key to get into any government building.”

The breach is believed to be the work of a foreign government, U.S. officials said, because of the sophistication involved. The U.S. officials said they are certain U.S. spy agencies themselves aren’t behind the back door. China and Russia are among the top suspected governments, though officials cautioned the investigation hasn’t reached conclusions.

It’s not yet clear what if any classified information could be affected, but U.S. officials said the Juniper Networks equipment is so widely used that it may take some time to determine what damage was done.

A senior administration official told CNN, “We are aware of the vulnerabilities recently announced by Juniper. The Department of Homeland Security has been and remains in close touch with the company. The administration remains committed to enhancing our national cybersecurity by raising our cyber defenses, disrupting adversary activity, and effectively responding to incidents when they occur.”

Juniper Networks’ security fix is intended to seal a back door that hackers created in order to remotely log into commonly used VPN networks to spy on communications that were supposed to be among the most secure. A free trial vpn has been helpful for those new to the VPN world to decide if it is right for them.

Juniper said that someone managed to get into its systems and write “unauthorized code” that “could allow a knowledgeable attacker to gain administrative access.”

Such access would allow the hacker to monitor encrypted traffic on the computer network and decrypt communications.

Juniper sells computer network equipment and routers to big companies and to U.S. government clients such as the Defense Department, Justice Department, FBI and Treasury Department. On its website, the company boasts of providing networks that “US intelligence agencies require.”

Its routers and network equipment are widely used by corporations, including for secure communications. Homeland Security officials are now trying to determine how many such systems are in use for U.S. government networks.

Juniper said in its security alert that it wasn’t aware of any “malicious exploitation of these vulnerabilities.” However, the alert also said that attackers would leave behind no trace of their activity by removing security logs that would show a breach.

“Note that a skilled attacker would likely remove these entries from the log file, thus effectively eliminating any reliable signature that the device had been compromised,” the Juniper security alert said. If encrypted communications were being monitored, “There is no way to detect that this vulnerability was exploited,” according to the Juniper security alert.

According to a Juniper Networks spokeswoman’s statement, “Once we identified these vulnerabilities, we launched an investigation and worked to develop and issue patched releases for the impacted devices. We also reached out to affected customers, strongly recommending that they update their systems.”

U.S. officials said it’s not clear how the Juniper source code was altered, whether from an outside attack or someone inside.

The work to alter millions of lines of source code is sophisticated. The system was compromised for three years before Juniper uncovered it in a routine review in recent weeks.

Juniper said it was also issuing a security fix for a separate bug that could allow a hacker to launch denial-of-service attacks on networks.