48 ms·

Critical vulnerabilities in Cisco products that the CIA can exploit? "Cisco vice president of services Mike Quinn, a former CIA operations officer, ..." [0] "

by rl3 10y ago

Critical vulnerabilities in Cisco products that the CIA can exploit? "Cisco vice president of services Mike Quinn, a former CIA operations officer, ..." [0] "... Cisco's recent acquisition of In-Q-Tel-backed security company ThreatGRID ..." [1] "After retiring with 30+ years of service from the Agency, I spent several years as adviser to Cisco System’s Chief Security Officer, and I found Cisco was doing great work; they’re one of the backbones of the internet." [2] Imagine that. [0] http://www.networkworld.com/article/2223473/data-center/cisco-vp-to-memo-leaker--finding-you-is-now--my-hobby-.html http://www.networkworld.com/article/2223473/data-center/cisc... [1] http://www.networkworld.com/article/2358453/security/cisco-purchase-of-cia-funded-company-may-fuel-distrust-abroad.html http://www.networkworld.com/article/2358453/security/cisco-p... [2] https://www.forbes.com/sites/realspin/2012/10/12/what-do-former-cia-spies-do-when-they-quit-the-spy-game/ https://www.forbes.com/sites/realspin/2012/10/12/what-do-for...

linkregister 10y ago
1. The vulnerability was probably exploited before the CIA guy joined Cisco. The Vault 7 cache contains some seriously legacy docs. 2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? 3. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community. 4. Telnet options are pretty arcane. It seems like an easy bug to write. The modus operandi of U.S. backdoor attempts in the past matches a different model. U.S. backdoor attempts fit two models: backdoor dependent on secret key (Dual_EC RNG), and backdoor dependent on physical sabotage (interdiction). This is stuff available in the Snowden docs and related news reports. It's a common HN meme that Cisco and Microsoft help the U.S. government spy, but there isn't credible evidence supporting it. They actively resist government espionage attempts. Yahoo, RSA, et. al. deserve the negative attention, not companies that fight the good fight.
- randomguy23 10y ago
  They PUBLICLY resist government espionage attempts. we don't know for sure what they do in private.
  - danielweber 10y ago
    Have they stopped beating their spouses yet?
    - deleted 10y ago
      [deleted]
- rl3 10y ago
  The edit window just expired as I attempted to amend my original comment, so I'll amend it here: Those links were the result of a few cursory Google searches. It wasn't intended as a comprehensive representation of Cisco's CIA ties, nor to imply that anyone mentioned was directly involved in backdoors. Rather, the point was that when a security-oriented organization employs ex-spooks, it increases the likelihood of spooky things happening. At the very minimum it fosters distrust. >2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? While I didn't mean to imply any specific individual, I'll address the underlying rationale: When someone's former employer is a powerful government spy agency built on secrets, the loyalty dynamic is a bit different than that of normal private sector job hopping. Moreover, I'm sure the CIA isn't stupid and tends to maintain relationships—intentionally or not—with former employees that cross over to private sector work, especially high-level people since they're already trusted, reliable, and may be taking positions that later prove to be beneficial to CIA interests in the future. >3. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community. This is a fair point. Given the nature of Cisco's products, and combined with recent leaks detailing the pervasive nature of US offensive cyber efforts, it should raise more suspicion than normal when former IC people go to work for a company dealing with network hardware. That said, I'm not sure how you'd quantify the number of former IC people Cisco hires versus a normal Fortune 500 company. For all I know it could even be lower than average. >... and backdoor dependent on physical sabotage (interdiction) ... This approach is far superior to baking vulnerabilities into entire product ranges (or even standards). It doesn't compromise the private sector in the process, beyond perhaps supply chain integrity. The flipside of course is that physical implants don't really scale well, but at least the blowback is relatively minimal when things go wrong. Not to mention it's just badass in a James Bond kind of way. >It's a common HN meme that Cisco and Microsoft help the U.S. government spy, but there isn't credible evidence supporting it. They actively resist government espionage attempts. While that's true, it's also possible a company can publicly say or do one thing—genuine or not—and actively do another because of either connections, or that they're being compelled against their will by NSLs. It's also possible to have factions or even individual employees within a company that are actively subverting security with the addition of backdoors, unbeknownst to management.
  - 10y ago
- samstave 10y ago
  >3. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community. This is actually a completely fair point... Look at all the ex SS at FB.
- avn2109 10y ago
  >> "Why would the ex-CIA guy hurt his current employer to help his former?" Once you're a made man in an intelligence service, you're in for life, regardless of whether or not your name appears on the official payroll.
  - linkregister 10y ago
    What movie did you get that from? It sounds really cool. Like a cross between Goodfellas and the Bourne Identity.
  - TelmoMenezes 10y ago
    Sounds legit.
- jsprogrammer 10y ago
  I'd like to know what a malformed command is. If the program accepts it, it accepts it. This sounds like more explicit disclosure of a designed feature (admin via telnet).
- cheez 10y ago
  > 2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? When you get into the big wide world of making billions of dollars, you'll find that people are more than willing to throw you a bone long after you're gone to make sure you're still invested. I've seen this first hand (unfortunately/fortunately, not the recipient of said bone).
- us0r 10y ago
  > It's a common HN meme that Cisco and Microsoft help the U.S. government spy, but there isn't credible evidence supporting it. They actively resist government espionage attempts. Microsoft was the only company featured in slides about teamwork and collaboration. https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...
- DonHopkins 10y ago
  You're right, there are some pretty arcane telnet options floating around out there, whose implementations are open to (mis)interpretation... https://tools.ietf.org/html/rfc748 https://tools.ietf.org/html/rfc748 NWG/RFC# 748, M. Crispin, 1 April 1978 Telnet Randomly-Lose Option 1. Command name and code. RANDOMLY-LOSE 256 2. Command meanings. IAC WILL RANDOMLY-LOSE The sender of this command REQUESTS permission to, or confirms that it will, randomly lose. IAC WON'T RANDOMLY-LOSE The sender of this command REFUSES to randomly lose. IAC DO RANDOMLY-LOSE The sender of this command REQUESTS that the receiver, or grants the receiver permission to, randomly lose. IAC DON'T RANDOMLY-LOSE The command sender DEMANDS that the receiver not randomly lose. 3. Default. WON'T RANDOMLY-LOSE DON'T RANDOMLY-LOSE i.e., random lossage will not happen. 4. Motivation for the option. Several hosts appear to provide random lossage, such as system crashes, lost data, incorrectly functioning programs, etc., as part of their services. These services are often undocumented and are in general quite confusing to the novice user. A general means is needed to allow the user to disable these features. 5. Description of the option. The normal mode does not allow random lossage; therefore the system is not allowed to crash, mung user files, etc. If the server wants to provide random lossage, it must first ask for permission from the user by sending IAC WILL RANDOMLY-LOSE. If the user wants to permit the server to randomly lose, it replys with IAC DO RANDOMLY-LOSE. Otherwise it sends IAC DONT RANDOMLY-LOSE, and the server is forbidden from randomly losing. Alternatively, the user could request the server to randomly lose, by sending IAC DO RANDOMLY-LOSE, and the server will either reply with IAC WILL RANDOMLY-LOSE, meaning that it will then proceed to do some random lossage (garbaging disk files is recommended for an initial implementation). Or, it could send IAC WONT RANDOMLY-LOSE, meaning that it insists upon being reliable. Since this is implemented as a TELNET option, it is expected that servers which do not implement this option will not randomly lose; ie, they will provide 100% reliable uptime.
- uremog 10y ago
  > 2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? I don't think quitting your CIA job lets you off the hook for essentially giving away something they consider to be a secret. Or at least I'm sure the CIA would not look at you kindly for doing so.
tptacek 10y ago
Cisco buying an In-Q-Tel-funded company is about the most banal observation you can make. In-Q-Tel is one of the more prominent investors in network and information security companies (IIRC, that's their founding charter!) and Cisco is the bizdev endgame strategy for most VC-funded security product companies. I doubt ThreatGrid is the only IQT company Cisco has bought. I am as certain they're not a CIA plant inside Cisco as I am of anything else in my perceived reality; I know several of their key people, one of whom has a framed Che poster. They're not the type. :) You're going to drive yourself seriously crazy if you try to trace every IQT investment that's been acquired by any company and then game them out as "compromised by the CIA".
- rl3 10y ago
  >I am as certain they're not a CIA plant inside Cisco as I am of anything else in my perceived reality ... Of course they aren't. All I'm saying is if you have a company that has a routine acquisition deal flow from the CIA's venture capital arm, that there's probably healthy working relationships there.
  - tptacek 10y ago
    By that logic, In-Q-Tel is a stroke of genius, because they've also built "healthy working relationships" with Network Appliance, IBM, Amazon, EMC, Microsoft, Intel, Oracle, Google, and Nokia. I think you just can't read anything into In-Q-Tel involvement with a company.
    - rl3 10y ago
      >By that logic, In-Q-Tel is a stroke of genius, because they've also built "healthy working relationships" with Network Appliance, IBM, Amazon, EMC, Microsoft, Intel, Oracle, Google, and Nokia. Perhaps the plan with In-Q-Tel was partly to achieve pervasive private sector influence, and it was somewhat successful. While I appreciate the conceited scare quotes there, I'm not saying that working relationships directly translate to backdoors, just that it translates to influence, and that can indirectly lead to bad things over time. >I think you just can't read anything into In-Q-Tel involvement with a company. As a thought experiment, say Open Whisper Systems took money from In-Q-Tel, or even acqui-hired a team from one of their portfolio companies. Right or wrong, people would very much read into it, and probably lose their minds in short order. Signal's user base would plummet overnight.
Beltiras 10y ago
I very much doubt that high-level employees are able to inject covert intrusion code without it raising a stink inside the company. If that were the goal then you would want an engineer, not a manager.

by rl3 10y ago

linkregister 10y ago

1. The vulnerability was probably exploited before the CIA guy joined Cisco. The Vault 7 cache contains some seriously legacy docs. 2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? 3. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community. 4. Telnet options are pretty arcane. It seems like an easy bug to write. The modus operandi of U.S. backdoor attempts in the past matches a different model. U.S. backdoor attempts fit two models: backdoor dependent on secret key (Dual_EC RNG), and backdoor dependent on physical sabotage (interdiction). This is stuff available in the Snowden docs and related news reports. It's a common HN meme that Cisco and Microsoft help the U.S. government spy, but there isn't credible evidence supporting it. They actively resist government espionage attempts. Yahoo, RSA, et. al. deserve the negative attention, not companies that fight the good fight.

randomguy23 10y ago
They PUBLICLY resist government espionage attempts. we don't know for sure what they do in private.
- danielweber 10y ago
  Have they stopped beating their spouses yet?
  - deleted 10y ago
    [deleted]
rl3 10y ago
The edit window just expired as I attempted to amend my original comment, so I'll amend it here: Those links were the result of a few cursory Google searches. It wasn't intended as a comprehensive representation of Cisco's CIA ties, nor to imply that anyone mentioned was directly involved in backdoors. Rather, the point was that when a security-oriented organization employs ex-spooks, it increases the likelihood of spooky things happening. At the very minimum it fosters distrust. >2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? While I didn't mean to imply any specific individual, I'll address the underlying rationale: When someone's former employer is a powerful government spy agency built on secrets, the loyalty dynamic is a bit different than that of normal private sector job hopping. Moreover, I'm sure the CIA isn't stupid and tends to maintain relationships—intentionally or not—with former employees that cross over to private sector work, especially high-level people since they're already trusted, reliable, and may be taking positions that later prove to be beneficial to CIA interests in the future. >3. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community. This is a fair point. Given the nature of Cisco's products, and combined with recent leaks detailing the pervasive nature of US offensive cyber efforts, it should raise more suspicion than normal when former IC people go to work for a company dealing with network hardware. That said, I'm not sure how you'd quantify the number of former IC people Cisco hires versus a normal Fortune 500 company. For all I know it could even be lower than average. >... and backdoor dependent on physical sabotage (interdiction) ... This approach is far superior to baking vulnerabilities into entire product ranges (or even standards). It doesn't compromise the private sector in the process, beyond perhaps supply chain integrity. The flipside of course is that physical implants don't really scale well, but at least the blowback is relatively minimal when things go wrong. Not to mention it's just badass in a James Bond kind of way. >It's a common HN meme that Cisco and Microsoft help the U.S. government spy, but there isn't credible evidence supporting it. They actively resist government espionage attempts. While that's true, it's also possible a company can publicly say or do one thing—genuine or not—and actively do another because of either connections, or that they're being compelled against their will by NSLs. It's also possible to have factions or even individual employees within a company that are actively subverting security with the addition of backdoors, unbeknownst to management.
- 10y ago
samstave 10y ago
>3. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community. This is actually a completely fair point... Look at all the ex SS at FB.
avn2109 10y ago
>> "Why would the ex-CIA guy hurt his current employer to help his former?" Once you're a made man in an intelligence service, you're in for life, regardless of whether or not your name appears on the official payroll.
- linkregister 10y ago
  What movie did you get that from? It sounds really cool. Like a cross between Goodfellas and the Bourne Identity.
- TelmoMenezes 10y ago
  Sounds legit.
jsprogrammer 10y ago
I'd like to know what a malformed command is. If the program accepts it, it accepts it. This sounds like more explicit disclosure of a designed feature (admin via telnet).
cheez 10y ago
> 2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? When you get into the big wide world of making billions of dollars, you'll find that people are more than willing to throw you a bone long after you're gone to make sure you're still invested. I've seen this first hand (unfortunately/fortunately, not the recipient of said bone).
us0r 10y ago
> It's a common HN meme that Cisco and Microsoft help the U.S. government spy, but there isn't credible evidence supporting it. They actively resist government espionage attempts. Microsoft was the only company featured in slides about teamwork and collaboration. https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...
DonHopkins 10y ago
You're right, there are some pretty arcane telnet options floating around out there, whose implementations are open to (mis)interpretation... https://tools.ietf.org/html/rfc748 https://tools.ietf.org/html/rfc748 NWG/RFC# 748, M. Crispin, 1 April 1978 Telnet Randomly-Lose Option 1. Command name and code. RANDOMLY-LOSE 256 2. Command meanings. IAC WILL RANDOMLY-LOSE The sender of this command REQUESTS permission to, or confirms that it will, randomly lose. IAC WON'T RANDOMLY-LOSE The sender of this command REFUSES to randomly lose. IAC DO RANDOMLY-LOSE The sender of this command REQUESTS that the receiver, or grants the receiver permission to, randomly lose. IAC DON'T RANDOMLY-LOSE The command sender DEMANDS that the receiver not randomly lose. 3. Default. WON'T RANDOMLY-LOSE DON'T RANDOMLY-LOSE i.e., random lossage will not happen. 4. Motivation for the option. Several hosts appear to provide random lossage, such as system crashes, lost data, incorrectly functioning programs, etc., as part of their services. These services are often undocumented and are in general quite confusing to the novice user. A general means is needed to allow the user to disable these features. 5. Description of the option. The normal mode does not allow random lossage; therefore the system is not allowed to crash, mung user files, etc. If the server wants to provide random lossage, it must first ask for permission from the user by sending IAC WILL RANDOMLY-LOSE. If the user wants to permit the server to randomly lose, it replys with IAC DO RANDOMLY-LOSE. Otherwise it sends IAC DONT RANDOMLY-LOSE, and the server is forbidden from randomly losing. Alternatively, the user could request the server to randomly lose, by sending IAC DO RANDOMLY-LOSE, and the server will either reply with IAC WILL RANDOMLY-LOSE, meaning that it will then proceed to do some random lossage (garbaging disk files is recommended for an initial implementation). Or, it could send IAC WONT RANDOMLY-LOSE, meaning that it insists upon being reliable. Since this is implemented as a TELNET option, it is expected that servers which do not implement this option will not randomly lose; ie, they will provide 100% reliable uptime.
uremog 10y ago
> 2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? I don't think quitting your CIA job lets you off the hook for essentially giving away something they consider to be a secret. Or at least I'm sure the CIA would not look at you kindly for doing so.

tptacek 10y ago

Cisco buying an In-Q-Tel-funded company is about the most banal observation you can make. In-Q-Tel is one of the more prominent investors in network and information security companies (IIRC, that's their founding charter!) and Cisco is the bizdev endgame strategy for most VC-funded security product companies. I doubt ThreatGrid is the only IQT company Cisco has bought. I am as certain they're not a CIA plant inside Cisco as I am of anything else in my perceived reality; I know several of their key people, one of whom has a framed Che poster. They're not the type. :) You're going to drive yourself seriously crazy if you try to trace every IQT investment that's been acquired by any company and then game them out as "compromised by the CIA".

rl3 10y ago
>I am as certain they're not a CIA plant inside Cisco as I am of anything else in my perceived reality ... Of course they aren't. All I'm saying is if you have a company that has a routine acquisition deal flow from the CIA's venture capital arm, that there's probably healthy working relationships there.
- tptacek 10y ago
  By that logic, In-Q-Tel is a stroke of genius, because they've also built "healthy working relationships" with Network Appliance, IBM, Amazon, EMC, Microsoft, Intel, Oracle, Google, and Nokia. I think you just can't read anything into In-Q-Tel involvement with a company.
  - rl3 10y ago
    >By that logic, In-Q-Tel is a stroke of genius, because they've also built "healthy working relationships" with Network Appliance, IBM, Amazon, EMC, Microsoft, Intel, Oracle, Google, and Nokia. Perhaps the plan with In-Q-Tel was partly to achieve pervasive private sector influence, and it was somewhat successful. While I appreciate the conceited scare quotes there, I'm not saying that working relationships directly translate to backdoors, just that it translates to influence, and that can indirectly lead to bad things over time. >I think you just can't read anything into In-Q-Tel involvement with a company. As a thought experiment, say Open Whisper Systems took money from In-Q-Tel, or even acqui-hired a team from one of their portfolio companies. Right or wrong, people would very much read into it, and probably lose their minds in short order. Signal's user base would plummet overnight.

Beltiras 10y ago

I very much doubt that high-level employees are able to inject covert intrusion code without it raising a stink inside the company. If that were the goal then you would want an engineer, not a manager.