4 ms·

If a compamy as big as Cisco can screw this kind of thing so badly, the future of IoT looks bleak.

• threatofrain 7y ago
  Cisco hasn't had a good reputation for awhile IMO.
  • snaky 7y ago
    Like any other network solutions vendor?
    • Arnt 7y ago
      I heard https://nvd.nist.gov/vuln/detail/CVE-2019-1804 https://nvd.nist.gov/vuln/detail/CVE-2019-1804 is Cisco's ninth backdoor so far this year. Not ninth security problem total, ninth backdoor. The ninth security problem Cisco shipped intentionally. Meanwhile, the router that serves my office is from a company that's had fewer than nine security problems in the past ten years. Two, I think, but I confess I don't really keep count (ditto the nine above). The precise number doesn't matter, because 1. If you want to be cynic you can point out that 9>0 and 2>0 and really they all suck. 2. And if you don't want to be cynic, then Cisco's recent record is in a league of its own. Steals the show. Makes other people's CVE count look like rounding errors.
      • unionpivo 7y ago
        Can you tell us your vendor? We are moving offices, and it's time to change equipment, Been reading about but still haven't gotten a good list. The only thing i found is great micro tick for wifi routing/AP's
        • Arnt 7y ago
          Mikrotik is okay for small routers, and so is Ubiquiti. If you get Mikrotiks, look for ones with angly metal boxes, not curvy plastic ones. And avoid the GUI stuff, use the CLI. If you're looking for larger routers I'd look at Juniper first. All of those will give you hardware that does the job and stays up, and provide uncomplicated upgrades for many years.
      • ti_ranger 7y ago
        > I heard https://nvd.nist.gov/vuln/detail/CVE-2019-1804 https://nvd.nist.gov/vuln/detail/CVE-2019-1804 is Cisco's ninth backdoor so far this year. Also the 9th they have fixed. > Not ninth security problem total, ninth backdoor. The ninth security problem Cisco shipped intentionally. How can you be sure it was intentional? > Meanwhile, the router that serves my office is from a company that's had fewer than nine security problems in the past ten years. How can you be sure? Did you audit all the source code yourself? Did you compile the source code yourself and are you running only binaries you compiled? Are you sure you can trust the compiler you used? Or, are you assuming that, because there isn't a CVE, there isn't a vulnerability or security problem? Fewer CVEs doesn't necessarily mean more secure, it may just mean less validation/testing etc. But sure, it could mean more secure, it's just not a guarantee.
        • geofft 7y ago
          Someone at Cisco intentionally created a keypair and intentionally put it in the image build process. They may or may not have intended to put it in production builds, but they clearly intended to set it up in some form, when they could have just ... not. If you take the easy but risky approach, you have certainly intentionally put yourself at risk. I've worked for a company that built OS images for distribution to customers. Putting my SSH key in development image builds would have been convenient, but there was too much of a risk of exactly this problem; instead we just made it easy enough to download an SSH key on a development build (and start up an sshd) once you've booted it and have physical access to a terminal. Also, a practical concern with disclosed vulnerabilities is that non-nation-state attackers (which are most of the attackers most people care about) are very unlikely to find and exploit a vulnerability that neither has a public CVE issued now nor will have one issued for years. So even if the alternative vendor has difficult-to-discover vulnerabilities, there is, in a very real sense, reduced exposure from those vulnerabilities compared to things that are disclosed and fixed. And especially if Cisco's disclosed-and-fixed vulnerabilities originate from outside vulnerability reports, there's a definite correlation between whether a vulnerability can be found by someone who would report it and whether a vulnerability can be found by someone who would exploit it.
        • Arnt 7y ago
    • godzillabrennus 7y ago
      Palo Alto seems to have a good reputation but that could be security through obscurity as no one can actually afford to use it.
      • Bluecobra 7y ago
        Palo Alto (like every vendor) has had similar vulnerabilities in the past with their web management. Typically management of a switch/firewall isn't exposed to directly to the Internet.
• kornish 7y ago
  You know what they say: the S in IoT stands for security.
  • zingmars 7y ago
    Can't wait for marketing people to catch up to this and call devices "SIoT" without changing anything about the product.
    • SmellyGeekBoy 7y ago
      Perhaps "Security Hardened Internet Things" would be more appropriate?
      • wolfgke 7y ago
        Relevant: https://twitter.com/internetofshit https://twitter.com/internetofshit
    • deleted 7y ago
      [deleted]
    • deleted 7y ago
      [deleted]
• Simple_Guy 7y ago
  in most offices i can just wait around until the cleaning lady comes, pretend to forget something, go in and loot anything I want. most people don't care about security until they get looted