22 ms·

Hardcoded Password Found in Cisco Software

280 points by wglb 9y ago

bringtheaction 9y ago
> The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical." I find this reassuring. It is the opposite of downplaying security issues.
- Rotdhizon 9y ago
  Cisco in the past few years has been good about handling security incidents, although it makes you wonder why they keep adding in hard coded password to their gear. Unless it's individual devs adding them in without documenting them or telling anyone else on the team about them.
  - kossae 9y ago
    Even still.. something like that should not make it past review, unless that process is broken as well.
  - ainiriand 9y ago
    I think they have some training in this particular matter now.
  - collinf 9y ago
    I'm sure the executives take issues like this incredibly seriously. None of this stuff is insidious in nature, it's just what happens when people bypass processes. Engineer doesn't take the time for proper password management -> Password gets left in source -> Other engineer who does code review misses password -> this continues for several iterations -> product gets released. Unfortunately this definitely happens more often than you would want to think.
    - paulie_a 9y ago
      > I'm sure the executives take issues like this incredibly seriously Considering Cisco's history of security issues they clearly don't take it seriously and it is unlikely that will change.
      - Jach 9y ago
        Couldn't the same have been said about Microsoft say pre-Vista? Of course taking security seriously doesn't magically make you have competent staff and eliminate embarrassing vulns, Windows has still had its share post-Vista. A lot of "taking security seriously" can just turn into security theater cheerleading and focusing too much on certain processes (especially response over prevention[0]) without ever doing effective threat modeling. [0] You fixed a reported admin-attacking-admin XSS bug within the SLA, good job! You're also letting admins upload binary blobs you then parse, has anyone run a fuzzer on this to help uncover any potential code execution bugs? Does anyone even know what a fuzzer is? No? Carry on... Until something gets reported.
        user5994461 9y ago
        I don't think that's a fair comparison. The internet didn't exist when windows 2000 and XP were done.
        paulie_a 9y ago
        Sarcasm, drunk or high?
        user5994461 9y ago
        None of these. In the decade around the 2000's, we went from almost zero computer in the developed world, to virtually every household having one and they're all permanently connected through a high speed network. That's a new universe of unplanned threats and attack vectors. None of this was anticipated when operating systems were designed, a few years before release.
  - mywacaday 9y ago
    I wonder given the prevalence of Cisco globally would it be worth a state getting an individual dev to insert the hard coded password or even an exploit broker given how much a zero day can sell for
  - deleted 9y ago
    [deleted]
  - deleted 9y ago
    [deleted]
- Covzire 9y ago
  The paranoid in me thinks that the low-privileged user account isn't as benign as some may think. If someone hard-coded a password on purpose they might have done so knowing of a vulnerability to escalate privileges. Then if it gets discovered, well, it was only a low-privilege account no big deal.
- criddell 9y ago
  I'll believe they are taking it seriously if they provide updates to customers without a current service contract. I genuinely hope they are.
reimertz 9y ago
I would love to know which cloud companies, such as Amazon AWS, Azure, Google Cloud Platform, etc. use Cisco at any critical part of their architecture. Because Cisco has proven over and over again that they can't be trusted. Or has something changed these last couple of years that I do not know about regarding how they handle security? Edit: I forgot that Google use their own hardware, but the article doesn't mention if they use it for their cloud platform. https://www.wired.com/2015/06/google-reveals-secret-gear-connects-online-empire https://www.wired.com/2015/06/google-reveals-secret-gear-con...
- lpasselin 9y ago
  Any examples except this issue?
  - reimertz 9y ago
    https://arstechnica.com/information-technology/2017/03/a-simple-command-allows-the-cia-to-commandeer-318-models-of-cisco-switches/ https://arstechnica.com/information-technology/2017/03/a-sim... https://arstechnica.com/information-technology/2018/01/cisco-drops-a-mega-vulnerability-alert-for-vpn-devices/ https://arstechnica.com/information-technology/2018/01/cisco... https://arstechnica.com/information-technology/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-for-years/ https://arstechnica.com/information-technology/2016/08/cisco... https://arstechnica.com/information-technology/2013/01/hack-turns-the-cisco-phone-on-your-desk-into-a-remote-bugging-device/ https://arstechnica.com/information-technology/2013/01/hack-...
  - craftkiller 9y ago
    https://news.ycombinator.com/item?id=16259127 https://news.ycombinator.com/item?id=16259127 https://news.ycombinator.com/item?id=13923669 https://news.ycombinator.com/item?id=13923669 https://news.ycombinator.com/item?id=13466187 https://news.ycombinator.com/item?id=13466187 https://news.ycombinator.com/item?id=14594331 https://news.ycombinator.com/item?id=14594331 https://news.ycombinator.com/item?id=5401496 https://news.ycombinator.com/item?id=5401496
  - disconnected 9y ago
joshmarlow 9y ago
Anybody got a Huawei router to try this password on? ;)
- deleted 9y ago
  [deleted]
DarronWyke 9y ago
"Cisco" and "security issue" go together like peanut butter and chocolate. Knowing this, and with the knowledge that IOS is some form of arcane torture, leads me to wonder: why hasn't Cisco been completely obsoleted by Juniper or other providers?
- gnbfulbvgjbvv 9y ago
  S/iOS/IOS
  - yorwba 9y ago
    s/^S/s
    - deleted 9y ago
      [deleted]
    - CiPHPerCoder 9y ago
      s/$/\//
      - BenjiWiebe 9y ago
        You'd think no one actually uses sed any more...
        yorwba 9y ago
        I use ed occasionally, just for fun. It's perfectly happy with s commands not being terminated by the separator.
        magnetic 9y ago
        What are the alternatives?
        wglb 9y ago
        I've seen folks use awk for some of those tasks, and another four letter programming language that i won't name.
mtgx 9y ago
Could it be related? https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/lawful/intercept/book/65LIch1.html https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6...
ransom1538 9y ago
When I was learning oracle (the db) an engineer told me: "The password is scott / tiger". I was like: "That seems easy to guess." Him: "No it's hard coded into oracle - it works everywhere!" http://www.dba-oracle.com/t_scott_tiger.htm http://www.dba-oracle.com/t_scott_tiger.htm
- gjvc 9y ago
  This is because an early employee of Oracle, Bruce Scott, had a family cat named "Tiger".
- emmelaich 9y ago
  It's not hard code into Oracle, it's just a part of the demo database. You can change it.
  - ransom1538 9y ago
    Don't forget!!!
Froyoh 9y ago
What was the password?
- analogmemory 9y ago
  hunter2
- Smaug123 9y ago
  This is not something you can expect ever to find out, burning with curiosity though we may all be. Since there's never a guarantee that every vulnerable system has been patched, it's very unlikely that Cisco will reveal the password. (It could, of course, be leaked somehow, but you will never find out officially.)
  - deleted 9y ago
    [deleted]
GordonS 9y ago
They found this during internal testing. Although this is bad, it's commendable that they released this info - many companies would have buried it.
athenot 9y ago
Here's the original link of the disclosure: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp https://tools.cisco.com/security/center/content/CiscoSecurit... Also, while there are no workarounds to that software version, Cisco has released free software updates that address the vulnerability described in this advisory.
sh-run 9y ago
This article incorrectly refers to ACS as a firewall system. ACS is used primarily to control management access to Network Devices via TACACS+ or RADIUS. It offers no firewall functionality whatsoever. This is arguably worse than it just being a firewall. I imagine that it wouldn't be a huge leap for someone to use this exploit to create a local account and policies to give themselves access to every router, switch, firewall and appliance in an enterprise.
gigatexal 9y ago
The guys over at packetpushers network (checkout their podcast) have been railing on Cisco for their software quality for years. This isn’t surprising to me. and yet Cisco remains a big sponsor for them. The balls on those guys: Literally laughing at the hand that feeds them.
bluesign 9y ago
"This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Software Release 11.6 only. No prior builds are affected by this vulnerability." This part smells fishy. Probably we will never learn how it is introduced for this build.
bridges 9y ago
Make crimes worth it. Gotcha.
bridges 9y ago
Make prison a good place to go with perks. Gotcha.
visibletrousers 9y ago
From cisco-sa-20180307-cpcp: "...an unauthenticated, local attacker ... could exploit this vulnerability by connecting to the affected system via Secure Shell" This is a remote root hole.
fishmeat 9y ago
What was the password that they found?

280 points by wglb 9y ago

> The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical." I find this reassuring. It is the opposite of downplaying security issues.

Rotdhizon 9y ago
Cisco in the past few years has been good about handling security incidents, although it makes you wonder why they keep adding in hard coded password to their gear. Unless it's individual devs adding them in without documenting them or telling anyone else on the team about them.
- kossae 9y ago
  Even still.. something like that should not make it past review, unless that process is broken as well.
- ainiriand 9y ago
  I think they have some training in this particular matter now.
- collinf 9y ago
  I'm sure the executives take issues like this incredibly seriously. None of this stuff is insidious in nature, it's just what happens when people bypass processes. Engineer doesn't take the time for proper password management -> Password gets left in source -> Other engineer who does code review misses password -> this continues for several iterations -> product gets released. Unfortunately this definitely happens more often than you would want to think.
  - paulie_a 9y ago
    > I'm sure the executives take issues like this incredibly seriously Considering Cisco's history of security issues they clearly don't take it seriously and it is unlikely that will change.
    - Jach 9y ago
      Couldn't the same have been said about Microsoft say pre-Vista? Of course taking security seriously doesn't magically make you have competent staff and eliminate embarrassing vulns, Windows has still had its share post-Vista. A lot of "taking security seriously" can just turn into security theater cheerleading and focusing too much on certain processes (especially response over prevention[0]) without ever doing effective threat modeling. [0] You fixed a reported admin-attacking-admin XSS bug within the SLA, good job! You're also letting admins upload binary blobs you then parse, has anyone run a fuzzer on this to help uncover any potential code execution bugs? Does anyone even know what a fuzzer is? No? Carry on... Until something gets reported.
      - user5994461 9y ago
        I don't think that's a fair comparison. The internet didn't exist when windows 2000 and XP were done.
        paulie_a 9y ago
        Sarcasm, drunk or high?
        user5994461 9y ago
        None of these. In the decade around the 2000's, we went from almost zero computer in the developed world, to virtually every household having one and they're all permanently connected through a high speed network. That's a new universe of unplanned threats and attack vectors. None of this was anticipated when operating systems were designed, a few years before release.
- mywacaday 9y ago
  I wonder given the prevalence of Cisco globally would it be worth a state getting an individual dev to insert the hard coded password or even an exploit broker given how much a zero day can sell for
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
Covzire 9y ago
The paranoid in me thinks that the low-privileged user account isn't as benign as some may think. If someone hard-coded a password on purpose they might have done so knowing of a vulnerability to escalate privileges. Then if it gets discovered, well, it was only a low-privilege account no big deal.
criddell 9y ago
I'll believe they are taking it seriously if they provide updates to customers without a current service contract. I genuinely hope they are.

reimertz 9y ago

I would love to know which cloud companies, such as Amazon AWS, Azure, Google Cloud Platform, etc. use Cisco at any critical part of their architecture. Because Cisco has proven over and over again that they can't be trusted. Or has something changed these last couple of years that I do not know about regarding how they handle security? Edit: I forgot that Google use their own hardware, but the article doesn't mention if they use it for their cloud platform. https://www.wired.com/2015/06/google-reveals-secret-gear-connects-online-empire https://www.wired.com/2015/06/google-reveals-secret-gear-con...

lpasselin 9y ago
Any examples except this issue?
- reimertz 9y ago
  https://arstechnica.com/information-technology/2017/03/a-simple-command-allows-the-cia-to-commandeer-318-models-of-cisco-switches/ https://arstechnica.com/information-technology/2017/03/a-sim... https://arstechnica.com/information-technology/2018/01/cisco-drops-a-mega-vulnerability-alert-for-vpn-devices/ https://arstechnica.com/information-technology/2018/01/cisco... https://arstechnica.com/information-technology/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-for-years/ https://arstechnica.com/information-technology/2016/08/cisco... https://arstechnica.com/information-technology/2013/01/hack-turns-the-cisco-phone-on-your-desk-into-a-remote-bugging-device/ https://arstechnica.com/information-technology/2013/01/hack-...
- craftkiller 9y ago
  https://news.ycombinator.com/item?id=16259127 https://news.ycombinator.com/item?id=16259127 https://news.ycombinator.com/item?id=13923669 https://news.ycombinator.com/item?id=13923669 https://news.ycombinator.com/item?id=13466187 https://news.ycombinator.com/item?id=13466187 https://news.ycombinator.com/item?id=14594331 https://news.ycombinator.com/item?id=14594331 https://news.ycombinator.com/item?id=5401496 https://news.ycombinator.com/item?id=5401496
- disconnected 9y ago

joshmarlow 9y ago

Anybody got a Huawei router to try this password on? ;)

deleted 9y ago
[deleted]

DarronWyke 9y ago

"Cisco" and "security issue" go together like peanut butter and chocolate. Knowing this, and with the knowledge that IOS is some form of arcane torture, leads me to wonder: why hasn't Cisco been completely obsoleted by Juniper or other providers?

gnbfulbvgjbvv 9y ago
S/iOS/IOS
- yorwba 9y ago
  s/^S/s
  - deleted 9y ago
    [deleted]
  - CiPHPerCoder 9y ago
    s/$/\//
    - BenjiWiebe 9y ago
      You'd think no one actually uses sed any more...
      - yorwba 9y ago
        I use ed occasionally, just for fun. It's perfectly happy with s commands not being terminated by the separator.
      - magnetic 9y ago
        What are the alternatives?
        wglb 9y ago
        I've seen folks use awk for some of those tasks, and another four letter programming language that i won't name.

mtgx 9y ago

Could it be related? https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/lawful/intercept/book/65LIch1.html https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6...

ransom1538 9y ago

When I was learning oracle (the db) an engineer told me: "The password is scott / tiger". I was like: "That seems easy to guess." Him: "No it's hard coded into oracle - it works everywhere!" http://www.dba-oracle.com/t_scott_tiger.htm http://www.dba-oracle.com/t_scott_tiger.htm

gjvc 9y ago
This is because an early employee of Oracle, Bruce Scott, had a family cat named "Tiger".
emmelaich 9y ago
It's not hard code into Oracle, it's just a part of the demo database. You can change it.
- ransom1538 9y ago
  Don't forget!!!

Froyoh 9y ago

What was the password?

analogmemory 9y ago
hunter2
Smaug123 9y ago
This is not something you can expect ever to find out, burning with curiosity though we may all be. Since there's never a guarantee that every vulnerable system has been patched, it's very unlikely that Cisco will reveal the password. (It could, of course, be leaked somehow, but you will never find out officially.)
- deleted 9y ago
  [deleted]

GordonS 9y ago

They found this during internal testing. Although this is bad, it's commendable that they released this info - many companies would have buried it.

athenot 9y ago

Here's the original link of the disclosure: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp https://tools.cisco.com/security/center/content/CiscoSecurit... Also, while there are no workarounds to that software version, Cisco has released free software updates that address the vulnerability described in this advisory.

sh-run 9y ago

This article incorrectly refers to ACS as a firewall system. ACS is used primarily to control management access to Network Devices via TACACS+ or RADIUS. It offers no firewall functionality whatsoever. This is arguably worse than it just being a firewall. I imagine that it wouldn't be a huge leap for someone to use this exploit to create a local account and policies to give themselves access to every router, switch, firewall and appliance in an enterprise.

gigatexal 9y ago

The guys over at packetpushers network (checkout their podcast) have been railing on Cisco for their software quality for years. This isn’t surprising to me. and yet Cisco remains a big sponsor for them. The balls on those guys: Literally laughing at the hand that feeds them.

bluesign 9y ago

"This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Software Release 11.6 only. No prior builds are affected by this vulnerability." This part smells fishy. Probably we will never learn how it is introduced for this build.

bridges 9y ago

Make crimes worth it. Gotcha.

bridges 9y ago

Make prison a good place to go with perks. Gotcha.

visibletrousers 9y ago

From cisco-sa-20180307-cpcp: "...an unauthenticated, local attacker ... could exploit this vulnerability by connecting to the affected system via Secure Shell" This is a remote root hole.

fishmeat 9y ago

What was the password that they found?