6 ms·

Cisco coughs up baker’s dozen of vulnerabilities and other security nasties

84 points by lnccl2j653l2 8y ago

wgx 8y ago
A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is?
- setquk 8y ago
  Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ https://arstechnica.com/information-technology/2013/06/nsa-g...
  - giancarlostoro 8y ago
    This makes me wonder if this is how Stuxnet was birthed, very interesting.
    - krylon 8y ago
      A former coworker of mine who works in industrial automation told me that Siemens had to give US authorities access to their source code; I would not be surprised if that source code had "leaked" to the intelligence services.
  - 394549 8y ago
    >> A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is? > Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ https://arstechnica.com/information-technology/2013/06/nsa-g... Though, it's worth noting that the NSA actually two roles: 1) ensuring the security of US Government communications systems and 2) conducting signals intelligence against other foreign communications systems. People focus so much on the former that they often forget the latter. Given their defensive role, being "done" with these exploits may mean simply having patched/secured all their systems against them.
- dx87 8y ago
  Probably not true. You can see from the leaked shadow brokers tools that they had to develop exploits to get on the devices, they didn't just have free access.
  - shshhdhs 8y ago
    I don’t follow. In most cases, you still have to develop exploits to “exploit” vulnerabilities. Very few of them just offer you a login prompt over the internet.
    - dx87 8y ago
      What don't you follow? If 3 letter agencies had been given backdoor access by Cisco, why would the 3 letter agencies need to develop exploits that take advantage of flaws in the software? Cisco could have just added port knocking instead of adding additional accounts and logic errors and hoping nobody except the US govt finds it.
      - drb91 8y ago
        Maybe I’m reading wrong, but nobody implied Cisco installed the backdoor at the request of the government.
        Buge 8y ago
        wgx seemed to be saying that.
- code_duck 8y ago
  I’m sure the NSA and other extreme security organizations knew about some of them. Is what you’re asking whether they have control or influence with Cisco regarding the release, other than choosing to not report?
lunchladydoris 8y ago
I've long heard the term but never really looked into where it comes from. If you're like me, check this out: https://www.todayifoundout.com/index.php/2010/09/why-a-bakers-dozen-is-13-instead-of-12/ https://www.todayifoundout.com/index.php/2010/09/why-a-baker...
stuff4ben 8y ago
> boils down to there being a "hidden command in the affected software", according to Cisco itself. It always amazes me that we continually release software with these backdoors in them. What is the thought process that's going on? Do they think security by obscurity really works? They must or else they wouldn't keep doing this. Cisco isn't a small company, they have the people-power, processes, and money to not do this. It literally saves no time or money when you figure in the cost to fixing the issue. US government conspiracy theories aside, I'm guessing it's just lazy developers, incompetent managers, or potentially intentional maliciousness from foreign governments or competitors.
- davemp 8y ago
  I feel like software reverse engineering should be done in more curriculums so developers can see just how easy it is to find backdoors as a relatively unskilled attacker.
  - pure-awesome 8y ago
    Whilst I think it would be useful, you're not teaching the more general lessons (such as not relying solely on security by obscurity). I suspect the kind of person who left in that backdoor would, after going through the course, simply make a slightly harder-to-find backdoor. (If anything, they might be more likely because they think they've taken into account THE vulnerability, when it is only a vulnerability).
- 7000skeletons 8y ago
  I've admittedly not worked on a project team as large as the ones you'll find at Cisco, but a lot of the time it comes down to deadlines and a team biting off more than they can chew rather than active maliciousness. Never attribute to malice what can adequately be explained by stupidity, and all that.
  - adrianN 8y ago
    If software with backdoors in it makes it past QA there is something fundamentally wrong with the processes in the company.
TheCapn 8y ago
> "It was not immediately clear whether or not the company has released any patches for this, with the page on its website merely referring readers to a login-protected page." Or as I learned in the last week with Cisco, it doesn't even matter if you have an account! You can't download software updates to the hardware they sold you unless you pay extra for a Service Contract! Leaving security holes in the software? Well gosh, we're real sorry about that. How 'bout you cough up a nominal fee for each of those "Security Appliances" you bought so we can give you the privilege of fixing our mistakes. Thanks!
- RKearney 8y ago
  That is completely untrue. You can open a case and get access to downloads outside your support contract if you reference a vulnerability that’s affecting your current hardware.
  - antsar 8y ago
    > open a case and get access [...] if you reference a vulnerability that’s affecting your current hardware. Ok, but that's bullshit, isn't it? Not all customers are going to be proactive/attentive enough to know their hardware is vulnerable. Cisco knows there is vulnerable gear in the wild, knows there is a fix, but withholds the fix until people come begging? Almost feels like the sort of thing that should be illegal (or at least on the losing end of a civil suit).
    - deleted 8y ago
      [deleted]
    - Buge 8y ago
      Didn't Microsoft do something similar by stopping support for Windows XP, but providing support longer for people who pay special support contracts? Of course Microsoft also released some free security updates beyond the date too.
  - vorpalhex 8y ago
    "I'm not holding you hostage and demanding $20k, you can instead just give me your first born child!" Holy crap does anybody actually think that's remotely acceptable behavior? I get better support on discounted Chinese routers I've bought in back alleys - they at least put out their patches for free.
radicalgold 8y ago
This all sounds very dramatic but I'm pretty sure that to take over the system is not that easy. Most vulnerabilities, if they are mediocre, have zero probability and most scenarios are pretty unlikely

84 points by lnccl2j653l2 8y ago

wgx 8y ago

A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is?

setquk 8y ago
Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ https://arstechnica.com/information-technology/2013/06/nsa-g...
- giancarlostoro 8y ago
  This makes me wonder if this is how Stuxnet was birthed, very interesting.
  - krylon 8y ago
    A former coworker of mine who works in industrial automation told me that Siemens had to give US authorities access to their source code; I would not be surprised if that source code had "leaked" to the intelligence services.
- 394549 8y ago
  >> A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is? > Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ https://arstechnica.com/information-technology/2013/06/nsa-g... Though, it's worth noting that the NSA actually two roles: 1) ensuring the security of US Government communications systems and 2) conducting signals intelligence against other foreign communications systems. People focus so much on the former that they often forget the latter. Given their defensive role, being "done" with these exploits may mean simply having patched/secured all their systems against them.
dx87 8y ago
Probably not true. You can see from the leaked shadow brokers tools that they had to develop exploits to get on the devices, they didn't just have free access.
- shshhdhs 8y ago
  I don’t follow. In most cases, you still have to develop exploits to “exploit” vulnerabilities. Very few of them just offer you a login prompt over the internet.
  - dx87 8y ago
    What don't you follow? If 3 letter agencies had been given backdoor access by Cisco, why would the 3 letter agencies need to develop exploits that take advantage of flaws in the software? Cisco could have just added port knocking instead of adding additional accounts and logic errors and hoping nobody except the US govt finds it.
    - drb91 8y ago
      Maybe I’m reading wrong, but nobody implied Cisco installed the backdoor at the request of the government.
      - Buge 8y ago
        wgx seemed to be saying that.
code_duck 8y ago
I’m sure the NSA and other extreme security organizations knew about some of them. Is what you’re asking whether they have control or influence with Cisco regarding the release, other than choosing to not report?

lunchladydoris 8y ago

I've long heard the term but never really looked into where it comes from. If you're like me, check this out: https://www.todayifoundout.com/index.php/2010/09/why-a-bakers-dozen-is-13-instead-of-12/ https://www.todayifoundout.com/index.php/2010/09/why-a-baker...

stuff4ben 8y ago

> boils down to there being a "hidden command in the affected software", according to Cisco itself. It always amazes me that we continually release software with these backdoors in them. What is the thought process that's going on? Do they think security by obscurity really works? They must or else they wouldn't keep doing this. Cisco isn't a small company, they have the people-power, processes, and money to not do this. It literally saves no time or money when you figure in the cost to fixing the issue. US government conspiracy theories aside, I'm guessing it's just lazy developers, incompetent managers, or potentially intentional maliciousness from foreign governments or competitors.

davemp 8y ago
I feel like software reverse engineering should be done in more curriculums so developers can see just how easy it is to find backdoors as a relatively unskilled attacker.
- pure-awesome 8y ago
  Whilst I think it would be useful, you're not teaching the more general lessons (such as not relying solely on security by obscurity). I suspect the kind of person who left in that backdoor would, after going through the course, simply make a slightly harder-to-find backdoor. (If anything, they might be more likely because they think they've taken into account THE vulnerability, when it is only a vulnerability).
7000skeletons 8y ago
I've admittedly not worked on a project team as large as the ones you'll find at Cisco, but a lot of the time it comes down to deadlines and a team biting off more than they can chew rather than active maliciousness. Never attribute to malice what can adequately be explained by stupidity, and all that.
- adrianN 8y ago
  If software with backdoors in it makes it past QA there is something fundamentally wrong with the processes in the company.

TheCapn 8y ago

> "It was not immediately clear whether or not the company has released any patches for this, with the page on its website merely referring readers to a login-protected page." Or as I learned in the last week with Cisco, it doesn't even matter if you have an account! You can't download software updates to the hardware they sold you unless you pay extra for a Service Contract! Leaving security holes in the software? Well gosh, we're real sorry about that. How 'bout you cough up a nominal fee for each of those "Security Appliances" you bought so we can give you the privilege of fixing our mistakes. Thanks!

RKearney 8y ago
That is completely untrue. You can open a case and get access to downloads outside your support contract if you reference a vulnerability that’s affecting your current hardware.
- antsar 8y ago
  > open a case and get access [...] if you reference a vulnerability that’s affecting your current hardware. Ok, but that's bullshit, isn't it? Not all customers are going to be proactive/attentive enough to know their hardware is vulnerable. Cisco knows there is vulnerable gear in the wild, knows there is a fix, but withholds the fix until people come begging? Almost feels like the sort of thing that should be illegal (or at least on the losing end of a civil suit).
  - deleted 8y ago
    [deleted]
  - Buge 8y ago
    Didn't Microsoft do something similar by stopping support for Windows XP, but providing support longer for people who pay special support contracts? Of course Microsoft also released some free security updates beyond the date too.
- vorpalhex 8y ago
  "I'm not holding you hostage and demanding $20k, you can instead just give me your first born child!" Holy crap does anybody actually think that's remotely acceptable behavior? I get better support on discounted Chinese routers I've bought in back alleys - they at least put out their patches for free.

radicalgold 8y ago

This all sounds very dramatic but I'm pretty sure that to take over the system is not that easy. Most vulnerabilities, if they are mediocre, have zero probability and most scenarios are pretty unlikely