3 ms·

Nation state backdoor found in Cisco firewalls (again..?) [video]

43 points by chii 3y ago

hulitu 3y ago
> Nation state backdoor found in Cisco firewalls (again..?) What do you mean "again" ? Over and over again. But people still buy Cisco, so it is not a big problem.
- jiggawatts 3y ago
  I remember a previous incident where a paranoid admin was comparing the logs of his Cisco firewall with a Linux firewall. He noticed they diverged whenever he called Cisco support. He worked out that the Cisco firewall had essentially a back door in it with features that orgs like the NSA would want, and Cisco support were using for “their own convenience”. Feature like hiding from logs, disabling activity LEDs, pattern matching with Regexes, and compressed and encrypted data smuggled out over other protocols in “dead space” and the like. I can’t quite find the specifics, but I remember that the “patch” just changed the password on the back door, but left it in place.
  - chii 3y ago
    > “patch” just changed the password on the back door so someone else malicious who knows about it has complete access to your router? That's almost as bad as leaving the default admin password unchanged.
  - 40185986 3y ago
    do you have any sources/links about this? It sounds very terrifying.
  - noncoml 3y ago
    I’ve worked for Cisco for 11 years (both TAC and R&D) and this anecdote is ridiculous. There is no such special back door for TAC. It would be stupidly incompetent if NSA would allow Cisco to use their back door for their own convenience. Also there is no back door visible in the source code. Again it would be stupid if there was since there are tens of thousands of engineers looking at the code that could decide to take advantage of it for their own benefit. If there is an NSA back door only very few select people in Cisco know about it.
    - oyashirochama 3y ago
      If there's an NSA backdoor, the NSA wouldn't let a corporation even know about it.
    - jijijijij 3y ago
      IIRC the documented incidents from the Snowden files were about hardware backdoors/additions added in transit. But they required CISCO to turn a blind eye, at the very least, I think.
    - jiggawatts 3y ago
      Juniper included the back-doored EC-DRBG algorithm into their VPN products on the orders of the NSA, so this kind of behaviour is not without precedent. Unless you're a very senior staff member, at the director level, you would not be privy to these kinds of orders. It would implemented without the knowledge of the vast majority of the staff. Your ignorance of a backdoor is not evidence of its absence.
      - deleted 3y ago
        [deleted]
      - sekh60 3y ago
        That was kinda their point. They weren't denying that one exists, just pointing out that the Cisco response that it was for support use was laughable.
        jiggawatts 3y ago
        Cisco never claimed it was for support use. It was more than some support techs knew about the back door, and were using it unofficially for their own convenience. The official statement, if I remember correctly, was brief, vaguely worded, and amount to: "We can't say anything, every US vendor is in the same boat as us, stop asking".
  - instagib 3y ago
    Air-gapped, the only way to go. https://www.welivesecurity.com/2021/12/01/jumping-air-gap-15-years-nation-state-effort/ https://www.welivesecurity.com/2021/12/01/jumping-air-gap-15... There are still several vectors even with the top security clearance procedures. They routinely miss things at security checkpoints. “Even a perfect air gap will be vulnerable to a variety of different attack vectors, including (but not limited to) the following: Physical compromise: An adversary bypasses physical security and gains access directly to the air-gapped network devices. Physical access is by far the most effective and obvious technique. Insider threats: Someone who is part of an organization and has access to air-gapped secure systems intentionally or unintentionally compromises a system. Supply chain compromise: A vendor with legitimate access to air-gapped systems unwittingly is compromised and brings infected devices into a network. Misconfiguration: Misconfiguration of access controls or permissions allows an attacker to access the air-gapped system through a separate device on the network. Social engineering (media drop): If an attacker was able to successfully conduct a malicious USB/media drop and an employee was to use that media within the air-gapped system, the network could be compromised. Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals, and magnetic fields are among a range of advanced tactics documented and demonstrated by researchers at Ben Gurion University. “ https://darktrace.com/blog/why-the-air-gap-is-not-enough https://darktrace.com/blog/why-the-air-gap-is-not-enough
    - c_o_n_v_e_x 3y ago
      >Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals, There's a pretty good video of a guy who drove a GPIO pin off of a microcontroller and successfully sent data via LoRA without a dedicated radio chipset or antenna. https://github.com/cnlohr/lolra https://github.com/cnlohr/lolra
tenlp 3y ago
What’s interesting is that the U.S. government, which was actually caught using Cisco’s backdoor, is now claiming that China used the backdoor. Snowden: The NSA planted backdoors in Cisco products https://www.infoworld.com/article/2608141/snowden--the-nsa-planted-backdoors-in-cisco-products.html https://www.infoworld.com/article/2608141/snowden--the-nsa-p...
- tenlp 3y ago
  I suddenly thought of a possible evidence, that is, they met each other at the back door
nubinetwork 3y ago
This guy is a cybersec clout chaser... just link to the article... https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices https://blog.talosintelligence.com/arcanedoor-new-espionage-...
- mavamaarten 3y ago
  The trend of making dramatic videos around simple written facts should die. I'd much rather read a long page than have to listen to someone rant about it, and that's true from simple tutorials to things like security reports / CVE's.
aaron695 3y ago
[dead]
deleted 3y ago
[deleted]
ChrisArchitect 3y ago
More discussion: https://news.ycombinator.com/item?id=40181896 https://news.ycombinator.com/item?id=40181896

43 points by chii 3y ago

> Nation state backdoor found in Cisco firewalls (again..?) What do you mean "again" ? Over and over again. But people still buy Cisco, so it is not a big problem.

jiggawatts 3y ago
I remember a previous incident where a paranoid admin was comparing the logs of his Cisco firewall with a Linux firewall. He noticed they diverged whenever he called Cisco support. He worked out that the Cisco firewall had essentially a back door in it with features that orgs like the NSA would want, and Cisco support were using for “their own convenience”. Feature like hiding from logs, disabling activity LEDs, pattern matching with Regexes, and compressed and encrypted data smuggled out over other protocols in “dead space” and the like. I can’t quite find the specifics, but I remember that the “patch” just changed the password on the back door, but left it in place.
- chii 3y ago
  > “patch” just changed the password on the back door so someone else malicious who knows about it has complete access to your router? That's almost as bad as leaving the default admin password unchanged.
- 40185986 3y ago
  do you have any sources/links about this? It sounds very terrifying.
- noncoml 3y ago
  I’ve worked for Cisco for 11 years (both TAC and R&D) and this anecdote is ridiculous. There is no such special back door for TAC. It would be stupidly incompetent if NSA would allow Cisco to use their back door for their own convenience. Also there is no back door visible in the source code. Again it would be stupid if there was since there are tens of thousands of engineers looking at the code that could decide to take advantage of it for their own benefit. If there is an NSA back door only very few select people in Cisco know about it.
  - oyashirochama 3y ago
    If there's an NSA backdoor, the NSA wouldn't let a corporation even know about it.
  - jijijijij 3y ago
    IIRC the documented incidents from the Snowden files were about hardware backdoors/additions added in transit. But they required CISCO to turn a blind eye, at the very least, I think.
  - jiggawatts 3y ago
    Juniper included the back-doored EC-DRBG algorithm into their VPN products on the orders of the NSA, so this kind of behaviour is not without precedent. Unless you're a very senior staff member, at the director level, you would not be privy to these kinds of orders. It would implemented without the knowledge of the vast majority of the staff. Your ignorance of a backdoor is not evidence of its absence.
    - deleted 3y ago
      [deleted]
    - sekh60 3y ago
      That was kinda their point. They weren't denying that one exists, just pointing out that the Cisco response that it was for support use was laughable.
      - jiggawatts 3y ago
        Cisco never claimed it was for support use. It was more than some support techs knew about the back door, and were using it unofficially for their own convenience. The official statement, if I remember correctly, was brief, vaguely worded, and amount to: "We can't say anything, every US vendor is in the same boat as us, stop asking".
- instagib 3y ago
  Air-gapped, the only way to go. https://www.welivesecurity.com/2021/12/01/jumping-air-gap-15-years-nation-state-effort/ https://www.welivesecurity.com/2021/12/01/jumping-air-gap-15... There are still several vectors even with the top security clearance procedures. They routinely miss things at security checkpoints. “Even a perfect air gap will be vulnerable to a variety of different attack vectors, including (but not limited to) the following: Physical compromise: An adversary bypasses physical security and gains access directly to the air-gapped network devices. Physical access is by far the most effective and obvious technique. Insider threats: Someone who is part of an organization and has access to air-gapped secure systems intentionally or unintentionally compromises a system. Supply chain compromise: A vendor with legitimate access to air-gapped systems unwittingly is compromised and brings infected devices into a network. Misconfiguration: Misconfiguration of access controls or permissions allows an attacker to access the air-gapped system through a separate device on the network. Social engineering (media drop): If an attacker was able to successfully conduct a malicious USB/media drop and an employee was to use that media within the air-gapped system, the network could be compromised. Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals, and magnetic fields are among a range of advanced tactics documented and demonstrated by researchers at Ben Gurion University. “ https://darktrace.com/blog/why-the-air-gap-is-not-enough https://darktrace.com/blog/why-the-air-gap-is-not-enough
  - c_o_n_v_e_x 3y ago
    >Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals, There's a pretty good video of a guy who drove a GPIO pin off of a microcontroller and successfully sent data via LoRA without a dedicated radio chipset or antenna. https://github.com/cnlohr/lolra https://github.com/cnlohr/lolra

tenlp 3y ago

What’s interesting is that the U.S. government, which was actually caught using Cisco’s backdoor, is now claiming that China used the backdoor. Snowden: The NSA planted backdoors in Cisco products https://www.infoworld.com/article/2608141/snowden--the-nsa-planted-backdoors-in-cisco-products.html https://www.infoworld.com/article/2608141/snowden--the-nsa-p...

tenlp 3y ago
I suddenly thought of a possible evidence, that is, they met each other at the back door

nubinetwork 3y ago

This guy is a cybersec clout chaser... just link to the article... https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices https://blog.talosintelligence.com/arcanedoor-new-espionage-...

mavamaarten 3y ago
The trend of making dramatic videos around simple written facts should die. I'd much rather read a long page than have to listen to someone rant about it, and that's true from simple tutorials to things like security reports / CVE's.

aaron695 3y ago

[dead]

deleted 3y ago

[deleted]

ChrisArchitect 3y ago

More discussion: https://news.ycombinator.com/item?id=40181896 https://news.ycombinator.com/item?id=40181896