4 ms·

We do. :) More importantly, there's also a Secure Development Lifecycle process that basically involves everyone. Security is not an "after the fact" feature t

We do. :) More importantly, there's also a Secure Development Lifecycle process that basically involves everyone. Security is not an "after the fact" feature that gets bolted on right before market time, it's a requirement for any project or feature and starts at design time, and gets evaluated several times during the development of the product (and after it's released). https://www.cisco.com/c/en/us/about/security-center/security-programs/secure-development-lifecycle/sdl-process.html#psr https://www.cisco.com/c/en/us/about/security-center/security...

adrianN 9y ago
Then how does a hardcoded password make it to the customer?
- frankharv 9y ago
  They are a USA company so maybe a National Security Letter or a FISA court order. The USA now has secret court systems and all USA companies are bound by them.
  - Kadin 9y ago
    That's a pretty asinine way to add a backdoor. I think we can give the intelligence community more credit than that. Plus, if you're an intelligence agency, the ideal backdoor is one you can use, and only you can use -- one that other adversaries can't take advantage of even if they know it's there. A hardcoded password is the opposite of that; once its existence leaks out, which it invariably will, it's open to everyone. Having a developer modify some crypto code in a subtle way that happens to reduce the effectiveness of the system such that it becomes marginally more vulnerable to a certain type of obscure cryptanalysis, preferably very resource-intensive analysis that only you can perform, is the direction I'd try for...
    - stordoff 9y ago
      If a intelligence service is adding the backdoor themselves, or the company is willingly working with them, sure, but I can imagine a scenario where a court orders them to provide access but does not specify the technical means. In that case, the company isn't particularly incentivised to make a subtle/NOBUS backdoor. I'd also wonder about it being a case of deniability - a hardcoded password can be written off as a development/debug oversight, whereas a more structured backdoor/deliberate vulnerability to cryptoanalysis is harder to explain away if found.
- haloux 9y ago
  Good one. But honestly, what kind of answer are you honestly seeking here?

adrianN 9y ago

Then how does a hardcoded password make it to the customer?

frankharv 9y ago
They are a USA company so maybe a National Security Letter or a FISA court order. The USA now has secret court systems and all USA companies are bound by them.
- Kadin 9y ago
  That's a pretty asinine way to add a backdoor. I think we can give the intelligence community more credit than that. Plus, if you're an intelligence agency, the ideal backdoor is one you can use, and only you can use -- one that other adversaries can't take advantage of even if they know it's there. A hardcoded password is the opposite of that; once its existence leaks out, which it invariably will, it's open to everyone. Having a developer modify some crypto code in a subtle way that happens to reduce the effectiveness of the system such that it becomes marginally more vulnerable to a certain type of obscure cryptanalysis, preferably very resource-intensive analysis that only you can perform, is the direction I'd try for...
  - stordoff 9y ago
    If a intelligence service is adding the backdoor themselves, or the company is willingly working with them, sure, but I can imagine a scenario where a court orders them to provide access but does not specify the technical means. In that case, the company isn't particularly incentivised to make a subtle/NOBUS backdoor. I'd also wonder about it being a case of deniability - a hardcoded password can be written off as a development/debug oversight, whereas a more structured backdoor/deliberate vulnerability to cryptoanalysis is harder to explain away if found.
haloux 9y ago
Good one. But honestly, what kind of answer are you honestly seeking here?