5 ms·

About time. We need open and verifiable firmware, at the very least, to be able to trust anything. Now if only they'd turn this lens on American-made devices w

About time. We need open and verifiable firmware, at the very least, to be able to trust anything. Now if only they'd turn this lens on American-made devices which are likewise opaque, insecure, and likely to be weaponized against us as soon as security updates stop....

TEP_Kim_Il_Sung 4y ago
That's not how this will be applied. Instead, I think, they will go after devices that don't contain government backdoors.
- 2OEH8eoCRo0 4y ago
  Which devices have government backdoors?
  - jbverschoor 4y ago
    Cisco iirc
    - 2OEH8eoCRo0 4y ago
      Source?
      - sschueller 4y ago
        See CVE: https://www.cvedetails.com/vulnerability-list.php?vendor_id=16&product_id=&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=4362&sha=b6b9f0966b7dbca88b729e5b85a1f8fffc37d986 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... At some point you have to think these are deliberate.
        TedDoesntTalk 4y ago
        Like the deliberate ones from TP-Link?
        2OEH8eoCRo0 4y ago
        Extraordinary claims require extraordinary evidence. All I see are a lot of CVEs.
        fbdab103 4y ago
        If not intentional, it at least points to a culture that cannot be trusted with producing secure devices.
        freshpots 4y ago
        Does it though? Are you a SWE?
        fbdab103 4y ago
        Given the number of times that a hard-coded password has been distributed on Cisco gear, yeah, I think it points to a cultural failure.
        Spooky23 4y ago
        That happened 15 years ago dude, on Linksys gear. The first CVE on that list is probably older than a few of the commenters on this thread.
        fbdab103 4y ago
        A cursory internet search reveals several that popped up within the past decade on Cisco's gear. Hard-coded passwords are table stakes, if that slips through, what else is lurking beneath the surface? Network hardware is to operate in the adversarial landscape which is the open internet. It requires an extreme, exhaustive workflow to ensure bugs do not slip through. That we repeatedly see these failures does not raise confidence. - 2016-01 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-air https://tools.cisco.com/security/center/content/CiscoSecurit... - 2018-03 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180307-cpcp.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2018-10 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20181003-cpcp-password.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2019-07 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cfnm-statcred https://tools.cisco.com/security/center/content/CiscoSecurit... Edit: formatting
      - croes 4y ago
        https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
    - notrealyme123 4y ago
      Sounds like it: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey https://tools.cisco.com/security/center/content/CiscoSecurit...
  - _jal 4y ago
    Aside from Cisco, Juniper has not exactly been forthcoming about backdoors: https://www.wired.com/2016/01/new-discovery-around-juniper-backdoor-raises-more-questions-about-the-company/ https://www.wired.com/2016/01/new-discovery-around-juniper-b... If my job were to ensure backdoor access to everything I could, at least to get started I'd sort a list of hardware vendors by marketshare.
  - glitchc 4y ago
    Almost all of them?
  - TEP_Kim_Il_Sung 4y ago
    Cell phones are required to have them by law. https://www.youtube.com/watch?v=D5cAfEGhH5o https://www.youtube.com/watch?v=D5cAfEGhH5o
- ouEight12 4y ago
  > don't contain <the correct> government backdoors. Fixed that for you. :/
  - TEP_Kim_Il_Sung 4y ago
    Any backdoor can be used by any government. It may take time, but it will be found and exploited. All they're doing is passing the buck... your buck, that is.
comboy 4y ago
> We need open and verifiable firmware, at the very least, to be able to trust anything. How? Even ignoring ASICs, I just don't see how it's possible. Even if you had no binary blobs anywhere (we are already in the wonderland), with process for turning source to binary, you need to trust compiler, cpu, flashing hardware and software and the whole lot of other things. And that's all ignoring the fact that hiding bad stuff in open source is many orders of magnitude cheaper than finding it. I don't think we have even a theoretical plan for fixing computer security, it just becomes ML bots arena.
- AnthonyMouse 4y ago
  > with process for turning source to binary, you need to trust compiler, cpu, flashing hardware and software and the whole lot of other things. "We should not solve this solvable problem because other problems exist" is false. Meanwhile the other problems have solutions, like reproducible builds, so that the attacker not only has to compromise your compiler/CPU/hardware, they also have to compromise any others the output result gets compared by, or one of them will differ and the attack will be detected.
  - shukantpal 4y ago
    > "We should not solve this solvable problem because other problems exist" is false. Without commenting on the truthiness of the comment you are replying to, you have constructed a strawman argument here. They weren't saying that the problem shouldn't be solved because other problems exist, rather that it might not be solvable b/c of so and so obstacles that don't seem to have a solution.
    - ClumsyPilot 4y ago
      The more accurate statement would be "we should not apply this silution because it only solves 60% of the problem. Instead we should despair abd do nothing at all"
- lrvick 4y ago
  You need deterministic builds of firmware artifacts proven to correspond to source code by multiple parties. You also need hardware purpose made to be user auditable. See: https://media.ccc.de/v/36c3-10690-open_source_is_insufficient_to_solve_trust_problems_in_hardware https://media.ccc.de/v/36c3-10690-open_source_is_insufficien...
deleted 4y ago
[deleted]

TEP_Kim_Il_Sung 4y ago

That's not how this will be applied. Instead, I think, they will go after devices that don't contain government backdoors.

2OEH8eoCRo0 4y ago
Which devices have government backdoors?
- jbverschoor 4y ago
  Cisco iirc
  - 2OEH8eoCRo0 4y ago
    Source?
    - sschueller 4y ago
      See CVE: https://www.cvedetails.com/vulnerability-list.php?vendor_id=16&product_id=&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=4362&sha=b6b9f0966b7dbca88b729e5b85a1f8fffc37d986 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... At some point you have to think these are deliberate.
      - TedDoesntTalk 4y ago
        Like the deliberate ones from TP-Link?
      - 2OEH8eoCRo0 4y ago
        Extraordinary claims require extraordinary evidence. All I see are a lot of CVEs.
        fbdab103 4y ago
        If not intentional, it at least points to a culture that cannot be trusted with producing secure devices.
        freshpots 4y ago
        Does it though? Are you a SWE?
        fbdab103 4y ago
        Given the number of times that a hard-coded password has been distributed on Cisco gear, yeah, I think it points to a cultural failure.
        Spooky23 4y ago
        That happened 15 years ago dude, on Linksys gear. The first CVE on that list is probably older than a few of the commenters on this thread.
        fbdab103 4y ago
        A cursory internet search reveals several that popped up within the past decade on Cisco's gear. Hard-coded passwords are table stakes, if that slips through, what else is lurking beneath the surface? Network hardware is to operate in the adversarial landscape which is the open internet. It requires an extreme, exhaustive workflow to ensure bugs do not slip through. That we repeatedly see these failures does not raise confidence. - 2016-01 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-air https://tools.cisco.com/security/center/content/CiscoSecurit... - 2018-03 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180307-cpcp.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2018-10 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20181003-cpcp-password.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2019-07 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cfnm-statcred https://tools.cisco.com/security/center/content/CiscoSecurit... Edit: formatting
    - croes 4y ago
      https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
  - notrealyme123 4y ago
    Sounds like it: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey https://tools.cisco.com/security/center/content/CiscoSecurit...
- _jal 4y ago
  Aside from Cisco, Juniper has not exactly been forthcoming about backdoors: https://www.wired.com/2016/01/new-discovery-around-juniper-backdoor-raises-more-questions-about-the-company/ https://www.wired.com/2016/01/new-discovery-around-juniper-b... If my job were to ensure backdoor access to everything I could, at least to get started I'd sort a list of hardware vendors by marketshare.
- glitchc 4y ago
  Almost all of them?
- TEP_Kim_Il_Sung 4y ago
  Cell phones are required to have them by law. https://www.youtube.com/watch?v=D5cAfEGhH5o https://www.youtube.com/watch?v=D5cAfEGhH5o
ouEight12 4y ago
> don't contain <the correct> government backdoors. Fixed that for you. :/
- TEP_Kim_Il_Sung 4y ago
  Any backdoor can be used by any government. It may take time, but it will be found and exploited. All they're doing is passing the buck... your buck, that is.

comboy 4y ago

> We need open and verifiable firmware, at the very least, to be able to trust anything. How? Even ignoring ASICs, I just don't see how it's possible. Even if you had no binary blobs anywhere (we are already in the wonderland), with process for turning source to binary, you need to trust compiler, cpu, flashing hardware and software and the whole lot of other things. And that's all ignoring the fact that hiding bad stuff in open source is many orders of magnitude cheaper than finding it. I don't think we have even a theoretical plan for fixing computer security, it just becomes ML bots arena.

AnthonyMouse 4y ago
> with process for turning source to binary, you need to trust compiler, cpu, flashing hardware and software and the whole lot of other things. "We should not solve this solvable problem because other problems exist" is false. Meanwhile the other problems have solutions, like reproducible builds, so that the attacker not only has to compromise your compiler/CPU/hardware, they also have to compromise any others the output result gets compared by, or one of them will differ and the attack will be detected.
- shukantpal 4y ago
  > "We should not solve this solvable problem because other problems exist" is false. Without commenting on the truthiness of the comment you are replying to, you have constructed a strawman argument here. They weren't saying that the problem shouldn't be solved because other problems exist, rather that it might not be solvable b/c of so and so obstacles that don't seem to have a solution.
  - ClumsyPilot 4y ago
    The more accurate statement would be "we should not apply this silution because it only solves 60% of the problem. Instead we should despair abd do nothing at all"
lrvick 4y ago
You need deterministic builds of firmware artifacts proven to correspond to source code by multiple parties. You also need hardware purpose made to be user auditable. See: https://media.ccc.de/v/36c3-10690-open_source_is_insufficient_to_solve_trust_problems_in_hardware https://media.ccc.de/v/36c3-10690-open_source_is_insufficien...

deleted 4y ago

[deleted]