3 ms·

“ we identified the full exploit chain that allowed one of the forged products to function: a previously undocumented vulnerability in a security component allo

“ we identified the full exploit chain that allowed one of the forged products to function: a previously undocumented vulnerability in a security component allowing for the devices Secure Boot restrictions to be bypassed.” I’m not following. Why wouldn’t a forged device function?

Nextgrid 6y ago
It seems weird that they'd see this as a vulnerability. If it's a counterfeit device then the manufacturer controls the hardware and the secure boot process and there is no vulnerability there, the device is working as intended and is trusting the manufacturer of the counterfeit device. This doesn't mean the genuine device is vulnerable.
- parliament32 6y ago
  Technically Secure Boot is the firmware verifying the bootloader -- not related to hardware. You can disable this on manufacturing but if the end user applies a Cisco update in the future that re-flashes the firmware, your changes will be gone.
- NovemberWhiskey 6y ago
  The security platform is vulnerable in that minor modifications to the original device would permit loading of non-genuine boot images; the fact that the counterfeits used the same vulnerability to make it look like they were loading a genuine boot image on counterfeit hardware doesn't change that. The platform is vulnerable because this is a condition that the designers intended to engineer against - it's vulnerable in the sense that Sony's PS2 platform turned out to be vulnerable to circumvention with modchips.
- theamk 6y ago
  Exactly the same technique can be used on the genuine device to bypass the secure boot and add a backdoor.
SteveNuts 6y ago
Because presumably the customer tried to apply new Cisco firmware on counterfeit hardware it wasn't designed to run on.
theamk 6y ago
I have no information about Cisco in particular, but a very common tactic to ensure the device is genuine is with some sort of security chip. The security chip has a private key embedded in it in such a way that private key can be used to sign stuff, but cannot be extracted directly. The (publically downloadable) software contains matching public key, and on boot, verifies that the known public key matches the private key embedded in security chip. Even if counterfeiters can buy the same kind of security chip, they'd have no private key to program there. And this means counterfeit devices would be detected on boot. To prevent the software check from being disabled altogether, the vendor adds Secure Boot which is supposed to detect software tampering. But as this article shows, it can be bypassed as well.
- Too 6y ago
  For verification, the chip only needs the public key. The SW signature is produced using the private key in factory.

Nextgrid 6y ago

It seems weird that they'd see this as a vulnerability. If it's a counterfeit device then the manufacturer controls the hardware and the secure boot process and there is no vulnerability there, the device is working as intended and is trusting the manufacturer of the counterfeit device. This doesn't mean the genuine device is vulnerable.

parliament32 6y ago
Technically Secure Boot is the firmware verifying the bootloader -- not related to hardware. You can disable this on manufacturing but if the end user applies a Cisco update in the future that re-flashes the firmware, your changes will be gone.
NovemberWhiskey 6y ago
The security platform is vulnerable in that minor modifications to the original device would permit loading of non-genuine boot images; the fact that the counterfeits used the same vulnerability to make it look like they were loading a genuine boot image on counterfeit hardware doesn't change that. The platform is vulnerable because this is a condition that the designers intended to engineer against - it's vulnerable in the sense that Sony's PS2 platform turned out to be vulnerable to circumvention with modchips.
theamk 6y ago
Exactly the same technique can be used on the genuine device to bypass the secure boot and add a backdoor.

SteveNuts 6y ago

Because presumably the customer tried to apply new Cisco firmware on counterfeit hardware it wasn't designed to run on.

theamk 6y ago

I have no information about Cisco in particular, but a very common tactic to ensure the device is genuine is with some sort of security chip. The security chip has a private key embedded in it in such a way that private key can be used to sign stuff, but cannot be extracted directly. The (publically downloadable) software contains matching public key, and on boot, verifies that the known public key matches the private key embedded in security chip. Even if counterfeiters can buy the same kind of security chip, they'd have no private key to program there. And this means counterfeit devices would be detected on boot. To prevent the software check from being disabled altogether, the vendor adds Secure Boot which is supposed to detect software tampering. But as this article shows, it can be bypassed as well.

Too 6y ago
For verification, the chip only needs the public key. The SW signature is produced using the private key in factory.