4 ms·
That's not how this will be applied. Instead, I think, they will go after devices that don't contain government backdoors.
by TEP_Kim_Il_Sung 4y ago
That's not how this will be applied. Instead, I think, they will go after devices that don't contain government backdoors.
- 2OEH8eoCRo0 4y agoWhich devices have government backdoors?
- jbverschoor 4y agoCisco iirc
- 2OEH8eoCRo0 4y agoSource?
- sschueller 4y agoSee CVE: https://www.cvedetails.com/vulnerability-list.php?vendor_id=16&product_id=&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=4362&sha=b6b9f0966b7dbca88b729e5b85a1f8fffc37d986 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... At some point you have to think these are deliberate.
- TedDoesntTalk 4y agoLike the deliberate ones from TP-Link?
- 2OEH8eoCRo0 4y agoExtraordinary claims require extraordinary evidence. All I see are a lot of CVEs.
- fbdab103 4y agoIf not intentional, it at least points to a culture that cannot be trusted with producing secure devices.
- freshpots 4y agoDoes it though? Are you a SWE?
- fbdab103 4y agoGiven the number of times that a hard-coded password has been distributed on Cisco gear, yeah, I think it points to a cultural failure.
- Spooky23 4y agoThat happened 15 years ago dude, on Linksys gear. The first CVE on that list is probably older than a few of the commenters on this thread.
- fbdab103 4y agoA cursory internet search reveals several that popped up within the past decade on Cisco's gear. Hard-coded passwords are table stakes, if that slips through, what else is lurking beneath the surface? Network hardware is to operate in the adversarial landscape which is the open internet. It requires an extreme, exhaustive workflow to ensure bugs do not slip through. That we repeatedly see these failures does not raise confidence. - 2016-01 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160113-air https://tools.cisco.com/security/center/content/CiscoSecurit... - 2018-03 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180307-cpcp.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2018-10 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20181003-cpcp-password.html https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-2018... - 2019-07 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cfnm-statcred https://tools.cisco.com/security/center/content/CiscoSecurit... Edit: formatting
- croes 4y agohttps://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
- notrealyme123 4y agoSounds like it: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey https://tools.cisco.com/security/center/content/CiscoSecurit...
- _jal 4y agoAside from Cisco, Juniper has not exactly been forthcoming about backdoors: https://www.wired.com/2016/01/new-discovery-around-juniper-backdoor-raises-more-questions-about-the-company/ https://www.wired.com/2016/01/new-discovery-around-juniper-b... If my job were to ensure backdoor access to everything I could, at least to get started I'd sort a list of hardware vendors by marketshare.
- glitchc 4y agoAlmost all of them?
- TEP_Kim_Il_Sung 4y agoCell phones are required to have them by law. https://www.youtube.com/watch?v=D5cAfEGhH5o https://www.youtube.com/watch?v=D5cAfEGhH5o
- ouEight12 4y ago> don't contain <the correct> government backdoors. Fixed that for you. :/
- TEP_Kim_Il_Sung 4y agoAny backdoor can be used by any government. It may take time, but it will be found and exploited. All they're doing is passing the buck... your buck, that is.