3 ms·
> everyone should update ssh Uh, if it was that easy. I recently(!) audited a brand new system for deployment in what most nations consider critical infrastruc
by archi42 3y ago
> everyone should update ssh
Uh, if it was that easy. I recently(!) audited a brand new system for deployment in what most nations consider critical infrastructure. They had just updated to the newest firmware supplied by a well-known and established manufacturer in that industry (not some garbage by a small company). That ran a dropbear ssh server version from 2016 with multiple CVEs, including an unauthenticated RCE. So essentially it's a root shell for anyone that can talk IP to that device.
I predict I will start seeing this terrapin in my Nessus reports soon, and stop seeing it when I enter pension.
- pas 3y agoit seems obvious that as long as there's no disclosure there's no real need to fix things. audits mean nothing if suddenly things can disappear from The Scope and appear somehow mItIgAtEd.
- archi42 3y ago"But they're ISO certified!" /s Strictly speaking audit is the wrong word for what I did (I'm not a certified auditor). I don't want to say too much in case I break some confidentiality agreement. Though I'm curious how that will be argued away, or if they get the manufacturer to get their shit together and build a new firmware...