5 ms·

At least this time they them selves found the security vulnerabilities and not someone else. I hope these internal audits are now a normal part of their busine

At least this time they them selves found the security vulnerabilities and not someone else. I hope these internal audits are now a normal part of their business.

willvarfar 9y ago
Are there any recent ones found by others? From the article: > Let's not criticize Cisco > The company discovered these flaws following as part of its massive series of internal audits it started back in December 2015. > At the time, security researchers found a backdoor account in Juniper software that could decrypt VPN traffic, and Cisco decided to hunt and root out any similar backdoors before attackers found them first. > The company discovered many backdoors and hardcoded accounts in the past two years as part of internal audits and has received some pretty unfair criticism for its efforts. > The most recent backdoors Cisco discovered was in March, when the company's engineers discovered two —one in Cisco's Prime Collaboration Provisioning (PCP) platform, and one in the IOS XE operating system.
- userbinator 9y ago
  The question is who put them there... and more interestingly, do the updates replace the backdoors with different, more hidden ones? To put it bluntly, even backdoor accounts need their credentials changed once in a while.
  - ptero 9y ago
    Most backdoors in commercial software are due to stupidity, not ill intent: software engineers putting a debug access point "I will remove it later before it goes into production" or business side having weird ideas "it would be so much simpler if we could log in and fix/reconfigure it for consumers". Finding those only to replace them with a more elaborate bug seems to be ill intent and unlikely for me. The bigger problem IMO is that the mentality above is still prevalent: for every two backdoors found a new one may be put in by another do-gooder.
    - _jal 9y ago
      Cisco is the Oracle of the networking world. I'm sure it is mostly incompetence, with only the occasional state-actor poisoning the well. But I see little evidence Cisco gives a damn or has any intention of actually attempting to regain some of the squandered trust. Which is fine, from my perspective; for the most part I like other vendors' kit quite a bit more anyway. I do think product liability law needs to kick in somewhere. If you have some Tourettes-like inability to stop writing back doors in security products, there should be some outside pressure to maybe get some help.
      - giancarlostoro 9y ago
        Is Cisco as evil as Oracle? Because ouch. Oracle is just plain evil. I have no reason to compare Cisco to Oracle yet. I usually prefer TP Link since they're usually effective and affordable to boot.
  - davidu 9y ago
    Absolutely not.
- retSava 9y ago
  > has received some pretty unfair criticism for its efforts. Ha, sure, one could say that the effort itself is commendable (internal audits and exploit hunts), but why does it feel it's a little like applauding a hitman for cleaning up the bloody mess they made in someones house?
athenot 9y ago
> I hope these internal audits are now a normal part of their business. They now are, at 3 stages: - During design, - Before early field trial, - Before production. Stuff like this is bad for everyone so we're spending a lot of effort upstream to ensure these things don't happen again. And yes it's embarrassing when we find existing products that have these vulns but there's a no-blame attitude that's really helping get things addressed instead of ignoring them (which is the default in large organizations). The faster we can find and address the errors of the past, the better off everyone is.
- EpicEng 9y ago
  >but there's a no-blame attitude that's really helping get things addressed instead of ignoring them (which is the default in large organizations) Ok, but you guys have been screwing the pooch in this regard for decades. What went wrong the last 20+ times?

At least this time they them selves found the security vulnerabilities and not someone else. I hope these internal audits are now a normal part of their business.

willvarfar 9y ago

Are there any recent ones found by others? From the article: > Let's not criticize Cisco > The company discovered these flaws following as part of its massive series of internal audits it started back in December 2015. > At the time, security researchers found a backdoor account in Juniper software that could decrypt VPN traffic, and Cisco decided to hunt and root out any similar backdoors before attackers found them first. > The company discovered many backdoors and hardcoded accounts in the past two years as part of internal audits and has received some pretty unfair criticism for its efforts. > The most recent backdoors Cisco discovered was in March, when the company's engineers discovered two —one in Cisco's Prime Collaboration Provisioning (PCP) platform, and one in the IOS XE operating system.

userbinator 9y ago
The question is who put them there... and more interestingly, do the updates replace the backdoors with different, more hidden ones? To put it bluntly, even backdoor accounts need their credentials changed once in a while.
- ptero 9y ago
  Most backdoors in commercial software are due to stupidity, not ill intent: software engineers putting a debug access point "I will remove it later before it goes into production" or business side having weird ideas "it would be so much simpler if we could log in and fix/reconfigure it for consumers". Finding those only to replace them with a more elaborate bug seems to be ill intent and unlikely for me. The bigger problem IMO is that the mentality above is still prevalent: for every two backdoors found a new one may be put in by another do-gooder.
  - _jal 9y ago
    Cisco is the Oracle of the networking world. I'm sure it is mostly incompetence, with only the occasional state-actor poisoning the well. But I see little evidence Cisco gives a damn or has any intention of actually attempting to regain some of the squandered trust. Which is fine, from my perspective; for the most part I like other vendors' kit quite a bit more anyway. I do think product liability law needs to kick in somewhere. If you have some Tourettes-like inability to stop writing back doors in security products, there should be some outside pressure to maybe get some help.
    - giancarlostoro 9y ago
      Is Cisco as evil as Oracle? Because ouch. Oracle is just plain evil. I have no reason to compare Cisco to Oracle yet. I usually prefer TP Link since they're usually effective and affordable to boot.
- davidu 9y ago
  Absolutely not.
retSava 9y ago
> has received some pretty unfair criticism for its efforts. Ha, sure, one could say that the effort itself is commendable (internal audits and exploit hunts), but why does it feel it's a little like applauding a hitman for cleaning up the bloody mess they made in someones house?

athenot 9y ago

> I hope these internal audits are now a normal part of their business. They now are, at 3 stages: - During design, - Before early field trial, - Before production. Stuff like this is bad for everyone so we're spending a lot of effort upstream to ensure these things don't happen again. And yes it's embarrassing when we find existing products that have these vulns but there's a no-blame attitude that's really helping get things addressed instead of ignoring them (which is the default in large organizations). The faster we can find and address the errors of the past, the better off everyone is.

EpicEng 9y ago
>but there's a no-blame attitude that's really helping get things addressed instead of ignoring them (which is the default in large organizations) Ok, but you guys have been screwing the pooch in this regard for decades. What went wrong the last 20+ times?