Networking giant Juniper Networks Inc. has made the somewhat embarrassing admission that it’s found “spying” code implanted into certain versions of ScreenOS, the operating system for its NetScreen firewall and VPN products.

The admission is an alarming one mainly because it smacks of some kind of state-sponsored spying initiative, and because the code has been present for at least three years.

Juniper said in an advisory to its customers that ScreenOS versions 6.2.0r15 to 6.2.0r18, and 6.3.0r12 to 6.3.0r20 all contain the vulnerability. The malicious code “could allow a knowledgeable attacker to gain administrative access to NetScreen devices and to decrypt VPN connections,” wrote Bob Worrall, Juniper’s chief information officer, in a blog post following the advisory.

He added that the unauthorized code was found following an internal review that was completed recently, and said Juniper has already issued critical patches to mitigate the problem.

“At this time, we have not received any reports of these vulnerabilities being exploited; however, we strongly recommend that customers update their systems and apply the patched releases with the highest priority,” Worrell added in his note.

Worrall refused to speculate on where the malicious code might have originated from. However, The Register surmises that it’s either due to an internal error that left rejected code in the production release of ScreenOS, or, more likely, due to parties unknown surreptitiously inserting the code so they can spy on Juniper’s customers.

Irrespective of where the code stems from, it’s bad news for Juniper, whose customers have potentially been spied upon for years without their knowledge.

Interestingly, the compromise of Juniper’s software by malicious code inserted explicitly for spying purposes echoes the tactics described by whistleblower Edward Snowden in documents leaked to the press in 2013.

Germany’s Der Spiegal revealed a fifty page catalog of hardware and software tools the NSA was using to infiltrate networking equipment back in December 2013. In that report, one of the tools was said to be specific to Juniper’s NetScreen products. The article spoke of a technique called “FEEDTROUGH” the NSA uses to insert two kinds of software implants inside NetScreen firewalls, which remain even if the device is rebooted or upgraded.

Der Spiegal said the NSA was also targeting other networking providers such as Cisco Systems Ltd. and China’s Huawei Technologies Co. Ltd.

Photo Credit: Skley via Compfight cc