There are articles on the Internet (e.g. this) that claim that the FBI/CIA injected security backdoors into OpenBSD.

I'd like to know if there are any other references to this issue. This would help in my Thesis addressing this or similar issues.

Could you recommend reliable resources, preferably academic papers?

(BibTex compatible is preferable)

  • Please someone with higher rep. and experiense on Security.SE , retag my question. It's not typical for this site, so I feel lost when trying to tag it properly. Feb 7, 2012 at 11:38
  • 1
    I feel like they don't really use tags on this site. Everyone browses the general page since there is so much less activity.
    – phpmeh
    Feb 7, 2012 at 15:56
  • 1
    @Grzegorz - Your question is vague. You do not even link to said articles, they could be written by random people, with no actual knowlege of what is contained in the OpenBSD source code. Unless you can prove that the FBI and/or CIA has modified the OpenBSD your Thesis is going to based on what could be pure fiction. What exactly is your question? I see no other possible tags.
    – Ramhound
    Feb 7, 2012 at 16:34
  • 2
    I cannot explain the reason people are giving this a postive vote. The question vague, the author wants us to do his research, and link him to academic papers. Part of the process of writting a Thesis is doing your own research. Furthermore there isn't an actual question, he is asking "can you recommend reliable resource" the only logical answer is of course "I can" I just refuse to do so.
    – Ramhound
    Feb 7, 2012 at 16:41
  • Hi @Grzegorz - this question doesn't really fit this site. Have a quick look at the faq for some more guidance.
    – Rory Alsop
    Feb 7, 2012 at 19:57

2 Answers 2


You should understand the OpenBSD allegations better before, no such thing as a backdoor was found. And it's mostly HOAX and FUD spread thanks to blogs and other funky websites that spread the rumor about an actual backdoor existing in the recent OpenBSD code. You might want to know exactly how it turned out before writing your Thesis.

Actually this was thoroughly discussed on the openbsd-misc/openbsd-tech mailing lists, you can access the archives easily.

The OpenBSD leader was contacted by an ex FBI agent or something who made allegations regarding some backdoor code implanted in the past by the FBI.

This led to a complete review of the source code by skilled developers, even not participating in OpenBSD's development. Not a single piece of what can look like a backdoor was found. Some bug fixing and improvements were possible thanks to this review, so in the end, these allegations made OpenBSD more reliable I guess.

You will find many many more details on the mailing list, use google and check for this thread: http://marc.info/?l=openbsd-tech&m=129236621626462&w=2

Very good subject, good luck with your Thesis.

EDIT: BTW, some people say bullshit on the ML, just dig through all the mails and don't make up your mind after reading one mail. Otto, Theo, Marc and Stuart are reliable, take their word for granted, they know what they are talking about.

EDIT2: One more interesting point is the bounty some people put up to encourage others to look for the backdoor.

EDIT3: Apparently I couldn't clearly express myself in my comment:

"I am not aware of other issues actually, as they say on the ML, the code changes fast and bugs happen all the time. However, what you can check is which where the remotely exploitable bugs on OpenBSD default install, they boast having only a few in a heck of a long time. It might be interesting to see how they happened"

I am not aware of any other issues concerning allegations of backdoors in OpenBSD. The code changes fast, even if the allegations are true and there had indeed been a backdoor introduced, it's most likely been fixed as a side effects of continuous development and auditing through time. OpenBSD claims on its webpage: "Only two remote holes in the default install, in a heck of a long time!". So it's worth looking these two remote holes, how they were introduced and why. This could add some relevance to the Thesis, one could analyze how related or unrelated to a third party (governments, ...) these two critical issues were.

  • I am not aware of other issues actually, as they say on the ML, the code changes fast and bugs happen all the time. However, what you can check is which where the remotely exploitable bugs on OpenBSD default install, they boast having only a few in a heck of a long time. It might be interesting to see how they happened.
    – Aki
    Feb 7, 2012 at 18:40
  • What? Your comment makes no sense. Please explain it within your answer. The article linked to is over 2 years ago, there wasn't any sort of additional information in the article itself, just what basically amounts to rumors. As you point out there was no evidence there was ever a reason for concern to begin with.
    – Ramhound
    Feb 7, 2012 at 19:38
  • Wiil do. The mails linked are 1 day earlier than the article linked in the question. You have dozens of mails (just click next in thread) from developers explaining the situation and investigating the allegation. Proof of their work can be found on the openbsd-cvs mailing list, just look for commits after December 14th 2010. They don't like to waste time and make public announcements, so the information is right there, in the tech mailing list and the CVS logs. Other blogs and paper just extrapolate information from these sources.
    – Aki
    Feb 7, 2012 at 19:50
  • Thanks @Aki, that was was I've been looking for. I wanted to clarify my understanding of whole issue with OpenBSD, FBI and IPSEC stack. Feb 7, 2012 at 21:04
  • You can dig through the full-disclosure mailing list archives as well, I recall seeing a funny issue about a well visible backdoor in an opensource software. The code was even commented saying that nobody even bothered looking at the code except bad guys. Underlining the failure of opensource in providing more code review/security 99% of the time.
    – Aki
    Feb 7, 2012 at 21:23

The closest thing I've seen to what you're asking (and it has nothing to do with state-sponsorship) is this speech by Ken Thompson during his Turing Award Lecture. It basically asks the question, if the gcc compiler was at one point poisoned to produce compilers which produced backdoor-ed code, and then the was used to compile gcc for a number of major distros and subsequently the code was destroyed, would we ever know?>

This is more a thought experiment on what could potentially happen if someone were to attack systems high enough up the stack. Interesting concept, there are ways to automate the output of a compiler to ensure that it's sane (assuming your tools were compiled with a good compiler...) but as far as I know they are not implemented on any of the major open-source projects.

  • The linked vulnerability has nothing to do with either intentional backdoors (sponsored or otherwise) or the creation of a backdoored compiler. It's simply an interesting bug caused by undefined behavior being undefined.
    – devnul3
    Feb 14, 2017 at 22:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.