4 ms·

> boils down to there being a "hidden command in the affected software", according to Cisco itself. It always amazes me that we continually release software wi

> boils down to there being a "hidden command in the affected software", according to Cisco itself. It always amazes me that we continually release software with these backdoors in them. What is the thought process that's going on? Do they think security by obscurity really works? They must or else they wouldn't keep doing this. Cisco isn't a small company, they have the people-power, processes, and money to not do this. It literally saves no time or money when you figure in the cost to fixing the issue. US government conspiracy theories aside, I'm guessing it's just lazy developers, incompetent managers, or potentially intentional maliciousness from foreign governments or competitors.

davemp 8y ago
I feel like software reverse engineering should be done in more curriculums so developers can see just how easy it is to find backdoors as a relatively unskilled attacker.
- pure-awesome 8y ago
  Whilst I think it would be useful, you're not teaching the more general lessons (such as not relying solely on security by obscurity). I suspect the kind of person who left in that backdoor would, after going through the course, simply make a slightly harder-to-find backdoor. (If anything, they might be more likely because they think they've taken into account THE vulnerability, when it is only a vulnerability).
7000skeletons 8y ago
I've admittedly not worked on a project team as large as the ones you'll find at Cisco, but a lot of the time it comes down to deadlines and a team biting off more than they can chew rather than active maliciousness. Never attribute to malice what can adequately be explained by stupidity, and all that.
- adrianN 8y ago
  If software with backdoors in it makes it past QA there is something fundamentally wrong with the processes in the company.
  - bdamm 8y ago
    Not so. The company processes are responding to a marketplace which allows products to ship with minimal security effort, thereby translating poor security into profit thanks to a more or less uninterested public. Nothing will change until legislation. For many kinds of companies they in fact cannot change until legislation.
  - lnccl2j653l2 8y ago
    "There are two things I am sure of after all these years: there is a growing societal need for high assurance software, and market forces are never going to provide it." - Earl Boebert Ross Anderson has a good reply to your statement in the 7th chapter of his book, 'Security Engineering'. [1] [1] https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c07.pdf https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c07.pdf
duxup 8y ago
For Cisco there's really not a great deal of incentive. I've seen the networking gear sales world. A huge % of customers just buy Cisco ... just because. It's a matter of fact. So if you're Cisco, there's no incentive. "Nobody ever got fired for buying IBM" is as much "Nobody ever got fired for buying Cisco".
- ekovarski 8y ago
  It used to be that buying from the likes of Cisco, IBM, hp, etc was simply referred to as buying the worlds largest diaper so that when the proverbial shite hit the fan, you could simply ask the vendor to take the blame... This isn't true as much anymore and if it's still applicable in your firm, you may want to re-evaluate if this really where you want stay and grow.
  - duxup 8y ago
    I don't think those sayings are really about blame as much as just tendencies by the buyer to do what they think of as playing it safe.

davemp 8y ago

I feel like software reverse engineering should be done in more curriculums so developers can see just how easy it is to find backdoors as a relatively unskilled attacker.

pure-awesome 8y ago
Whilst I think it would be useful, you're not teaching the more general lessons (such as not relying solely on security by obscurity). I suspect the kind of person who left in that backdoor would, after going through the course, simply make a slightly harder-to-find backdoor. (If anything, they might be more likely because they think they've taken into account THE vulnerability, when it is only a vulnerability).

7000skeletons 8y ago

I've admittedly not worked on a project team as large as the ones you'll find at Cisco, but a lot of the time it comes down to deadlines and a team biting off more than they can chew rather than active maliciousness. Never attribute to malice what can adequately be explained by stupidity, and all that.

adrianN 8y ago
If software with backdoors in it makes it past QA there is something fundamentally wrong with the processes in the company.
- bdamm 8y ago
  Not so. The company processes are responding to a marketplace which allows products to ship with minimal security effort, thereby translating poor security into profit thanks to a more or less uninterested public. Nothing will change until legislation. For many kinds of companies they in fact cannot change until legislation.
- lnccl2j653l2 8y ago
  "There are two things I am sure of after all these years: there is a growing societal need for high assurance software, and market forces are never going to provide it." - Earl Boebert Ross Anderson has a good reply to your statement in the 7th chapter of his book, 'Security Engineering'. [1] [1] https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c07.pdf https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c07.pdf

duxup 8y ago

For Cisco there's really not a great deal of incentive. I've seen the networking gear sales world. A huge % of customers just buy Cisco ... just because. It's a matter of fact. So if you're Cisco, there's no incentive. "Nobody ever got fired for buying IBM" is as much "Nobody ever got fired for buying Cisco".

ekovarski 8y ago
It used to be that buying from the likes of Cisco, IBM, hp, etc was simply referred to as buying the worlds largest diaper so that when the proverbial shite hit the fan, you could simply ask the vendor to take the blame... This isn't true as much anymore and if it's still applicable in your firm, you may want to re-evaluate if this really where you want stay and grow.
- duxup 8y ago
  I don't think those sayings are really about blame as much as just tendencies by the buyer to do what they think of as playing it safe.