It's Thursday the 14th of January 2016, and it's now 25 days after I first heard about the Juniper backdoor (I heard about it on Monday the 21st of December 2015) and I still haven't patched it yet. We don't use the VPN and have never had SSH open to the internet so this isn't a world ending bug for us but it's still something pretty major that I want fixed.

When I heard about the bug I went off to the Juniper website to download the update but to my surprise I was greeted with this:

I needed an account to download software updates. I didn't have one¹, so I went to sign up.

In the sign up form I needed my device serial number, so I went off and looked up the serial number. Then when I submitted it, I got a message saying my account needed to be validated and that I would get an email soon. I'm not sure if validation is a manual process or the flood of new sign ups from people wanting to patch their kit just overwhelmed their servers² but 24 hours later I still had no email. So I tried to sign up again but it said there was already a pending application for my email address³ so validation was clearly still ongoing.

Finally at 20:37 on Thursday (just over four days later) the email with my security key to activate my account was sent, it said I needed to activate my account by the 3rd of January or the key would expire. The only problem is our office had closed for the end of year holidays at 17:00 on the 24th (we closed 4 hours before the validation email was sent) and our office wouldn't be open again until the 4th of January (the day after the activation key expired).⁴

On Monday the 4th when I got to work and found the email with my (now expired) security key. So I went to try again to create an account, only to be given this message:

currently here but it may be removed

Juniper were doing maintenance and wouldn't be allowing sign ups for another week and a half.

So here we are Thursday morning, and I still haven't created an account or downloaded a patch yet but hopefully today I will be able sign up. And who knows if I get validated a bit more quickly I might even be able to secure my kit some time this week. I'm not sure what Juniper thinks it's achieving by not letting unregistered users download security updates⁵ but when I am looking at buying firewalls in future I will be looking for a brand that doesn't lock it's software updates away. Most likely something open source like PFSense, MikroTik or maybe something that can run VyOS.

Maybe I've got my priorities the wrong way around but I'm far more annoyed by the process I've had to go through to fix the backdoor than I was about the fact that there was a backdoor in the first place.