7 ms·
Multiple Severe Vulnerabilities Reported in Juniper Networks Hardware
- onetimemanytime 8y agoIn other words, several other (non-friendly) countries have their own NSA. Live by the sword and all...
- throwaway5752 8y agoAnd those countries would not engage in surveillance if the US did not? You create a 2 country elementary payoff matrix for that game and tell everyone what the Nash equilibrium is.
- xvector 8y agoWhat does your comment say when translated to the language of mere mortals? Asking for a friend
- mrgalaxy 8y ago> And those countries would not engage in surveillance if the US did not? A rhetorical question about whether other countries would spy on citizens if the US were to stop. (Hint, the answer is that they absolutely would continue). > You create a 2 country elementary payoff matrix for that game and tell everyone what the Nash equilibrium is. I think this is saying that there is nothing for other countries to gain by stopping surveillance programs, even if the US were to. This is the Nash equilibrium[1]. [1]: https://en.wikipedia.org/wiki/Nash_equilibrium https://en.wikipedia.org/wiki/Nash_equilibrium
- deleted 8y ago[deleted]
- onetimemanytime 8y agoNever said or meant to say that. Nations have spied and will spy on each other. Just suggested that Juniper had been pwned, it seems unlikely for 30 or so vulnerabilities to be disclosed at the same time otherwise.
- anon49124 8y agoFreeBSD vulns or Junos introduced?
- gonzo 8y agoMostly OpenSSH
- sydney6 8y ago'The affected SSHD configuration has the PermitEmptyPasswords option set to "yes".' Wow.
- spydum 8y agoHonestly this not that odd. If you have local users with no password (not normal), and ssh exposed, you prob have bigger issues. Do agree tho, this is a stupid default and surprising it got past any sort of system hardening checklist.
- sydney6 8y agoiirc, OpenWRT also uses password-less root access via ssh by default and indeed, one might find these kind of configs in provisioning setups quite often. What are the options these days besides default user/pw? The (Plastic)Router from my ISP has this sticker on the back with a custom default pw for user access. Always wondered how this works.. probably somehow derived from MAC addresses and/or other factors.
- pwnna 8y agoThe last time I checked the password-less root is on first setup with telnet, accessible only via LAN and with WIFI off. The first thing it asks you to do is to set a password, before enabling SSH.
- itomato 8y agoIt's a nice day to consider a Linux-based whitebox switch.
- dogecoinbase 8y agoThat way when a vulnerability is found in your control plane, there's no one to issue a bulletin, so no problem!
- SEJeff 8y agoFun fact, Arista switches are very lightly modified minimal Fedora installs with some fancy hardware. The entire userspace (literally all of it) is written in well done python and the magic is all in their asics. I got to RE their entire firmware as part of R&D at one of my previous employers.
- xvf22 8y agoDon't they run on commodity Broadcom ASICs?
- cgh 8y agoYes but then again, so do some Cisco switches nowadays. Arista's management team is former Cisco as well. There is a tangled legal history between the two companies, with Cisco claiming various patent infringements. So far as I know, none of the claims are hardware-related.
- xvf22 8y agoPrevious poster claimed that all of the magic was hardware but I've always been told that it was in the software. HPE now seems to have some agreement with Arista.
- mcpherrinm 8y agoModern network ASICs are highly-programmable devices. So you can implement a lot of magic on the same hardware as competitors. It's really not one way or the other, but the software and hardware working together that's important. [disclaimer: I am a former Arista employee. I did some of the "light" Fedora modifications.]
- based2 8y agohttps://www.reddit.com/r/netsec/comments/9n2o7c/multiple_severe_vulnerabilities_reported_in/ https://www.reddit.com/r/netsec/comments/9n2o7c/multiple_sev...