6 ms·

For anyone wondering, it's the Cisco CA/B-F Root CA: http://www.cisco.com/security/pki/policies/CiscoRXC-CP.pdf http://www.cisco.com/security/pki/policies/Cisc

by gnoway 11y ago

For anyone wondering, it's the Cisco CA/B-F Root CA: http://www.cisco.com/security/pki/policies/CiscoRXC-CP.pdf http://www.cisco.com/security/pki/policies/CiscoRXC-CP.pdf They should know better.

joosters 11y ago
From that document: 3.1.2 Need for Names to Be Meaningful The Issuing CA shall ensure that the subject name listed in all certificates has a reasonable association with the authenticated information of the subscriber. The hypocrites can't even manage that with their own 'RXC' CA name.
boardwaalk 11y ago
Does anyone know why Cisco would need a root CA on Windows machines...?
- chinathrow 11y ago
  To have $largeCompany buying their security suite where they can MITM on the proxy/appliance/gw/whatever without generating any alerts on the client side?
  - HoochTHX 11y ago
    This.
    - MichaelGG 11y ago
      If they misused the CA for that, there'd be a lot of backlash (cause it'd be detected). Apps would start blacklisting it. Seems like they'd have a better plan than that.
      - eli 11y ago
        I don't think it is intended to be undetected. Plenty of large organizations use security appliances that MITM all traffic. Though I'd prefer they do it by pushing their own BigCo certificate to the boxes they own than relying on a cert that exists in all copies of Windows.
        jessaustin 11y ago
        They want people to be able to BYOD and not know what's going on. (I'm sure that most employees were informed in some opaque memo, but that only goes so far.) "Our shared network works best with Microsoft phones." Hey, this is a new marketing effort for all those crap Lumias they're trying to unload!
        MichaelGG 11y ago
        So you're positing that Microsoft is going to intentionally destroy their TLS-CA verification system so any company can compromise any Windows device in the name of BYOD, without explicit action from the user?
        jessaustin 11y ago
        As we've been told many times, "it ain't a bug it's a feature". Sure, you and I don't want to tell the DLP guys our bank passwords, but most people already don't care. It's not feasible anymore to just block TLS, and supporting client proxy config is so tedious.
        MichaelGG 11y ago
        Think about how it'd have to work. By including a "compromised" cert that any company can get use, and that every Windows customer trusts, the CA system would be entirely destroyed. Microsoft wouldn't do that - it makes zero sense. Cisco might have something that having a CA for makes easier, but including a MITM cert in every Windows install is not close to reality.
        e12e 11y ago
- MichaelGG 11y ago
  Maybe as part of a way to secure the connection to their appliances? They could auto issue certs after verifying ownership. Maybe they're gonna give appliances a name off their own DNS <whatever>.mycloud.cisco? Hell maybe they're becoming a real CA and gonna sell trust services. Dunno how MS's process is, but with Firefox there's a nice application process that's very open and you can see their claims.
  - chinathrow 11y ago
    Indeed. https://wiki.mozilla.org/CA:How_to_apply https://wiki.mozilla.org/CA:How_to_apply However, nothing to bee seen in bugzilla about Cisco regarding their new CA. I wonder if it is MS only? https://bugzilla.mozilla.org/buglist.cgi?quicksearch=cisco https://bugzilla.mozilla.org/buglist.cgi?quicksearch=cisco
    - e12e 11y ago
      Requiring Internet Explorer for switch management sounds like exactly the kind of stupid Cisco might go for. These days Chrome/chromium uses the system store AFAIK, so at least you can get surprising breakage in your management tool that isn't due to TLS, but rather some kind of IE compatibility hack... ;-)
chinathrow 11y ago
Quick question: How did you find that document? It's not even indexed in Google so far.
- gnoway 11y ago
  I used DuckDuckGo.
castillar76 11y ago
One might gently point out that the SubjectName in that cert is "C=US, O=Cisco Systems, CN=Cisco RXC-R2". Microsoft just seems to have abbreviated it to "RXC-R2".

by gnoway 11y ago

For anyone wondering, it's the Cisco CA/B-F Root CA: http://www.cisco.com/security/pki/policies/CiscoRXC-CP.pdf http://www.cisco.com/security/pki/policies/CiscoRXC-CP.pdf They should know better.

joosters 11y ago

From that document: 3.1.2 Need for Names to Be Meaningful The Issuing CA shall ensure that the subject name listed in all certificates has a reasonable association with the authenticated information of the subscriber. The hypocrites can't even manage that with their own 'RXC' CA name.

boardwaalk 11y ago

Does anyone know why Cisco would need a root CA on Windows machines...?

chinathrow 11y ago
To have $largeCompany buying their security suite where they can MITM on the proxy/appliance/gw/whatever without generating any alerts on the client side?
- HoochTHX 11y ago
  This.
  - MichaelGG 11y ago
    If they misused the CA for that, there'd be a lot of backlash (cause it'd be detected). Apps would start blacklisting it. Seems like they'd have a better plan than that.
    - eli 11y ago
      I don't think it is intended to be undetected. Plenty of large organizations use security appliances that MITM all traffic. Though I'd prefer they do it by pushing their own BigCo certificate to the boxes they own than relying on a cert that exists in all copies of Windows.
      - jessaustin 11y ago
        They want people to be able to BYOD and not know what's going on. (I'm sure that most employees were informed in some opaque memo, but that only goes so far.) "Our shared network works best with Microsoft phones." Hey, this is a new marketing effort for all those crap Lumias they're trying to unload!
        MichaelGG 11y ago
        So you're positing that Microsoft is going to intentionally destroy their TLS-CA verification system so any company can compromise any Windows device in the name of BYOD, without explicit action from the user?
        jessaustin 11y ago
        As we've been told many times, "it ain't a bug it's a feature". Sure, you and I don't want to tell the DLP guys our bank passwords, but most people already don't care. It's not feasible anymore to just block TLS, and supporting client proxy config is so tedious.
      - MichaelGG 11y ago
        Think about how it'd have to work. By including a "compromised" cert that any company can get use, and that every Windows customer trusts, the CA system would be entirely destroyed. Microsoft wouldn't do that - it makes zero sense. Cisco might have something that having a CA for makes easier, but including a MITM cert in every Windows install is not close to reality.
        e12e 11y ago
MichaelGG 11y ago
Maybe as part of a way to secure the connection to their appliances? They could auto issue certs after verifying ownership. Maybe they're gonna give appliances a name off their own DNS <whatever>.mycloud.cisco? Hell maybe they're becoming a real CA and gonna sell trust services. Dunno how MS's process is, but with Firefox there's a nice application process that's very open and you can see their claims.
- chinathrow 11y ago
  Indeed. https://wiki.mozilla.org/CA:How_to_apply https://wiki.mozilla.org/CA:How_to_apply However, nothing to bee seen in bugzilla about Cisco regarding their new CA. I wonder if it is MS only? https://bugzilla.mozilla.org/buglist.cgi?quicksearch=cisco https://bugzilla.mozilla.org/buglist.cgi?quicksearch=cisco
  - e12e 11y ago
    Requiring Internet Explorer for switch management sounds like exactly the kind of stupid Cisco might go for. These days Chrome/chromium uses the system store AFAIK, so at least you can get surprising breakage in your management tool that isn't due to TLS, but rather some kind of IE compatibility hack... ;-)

chinathrow 11y ago

Quick question: How did you find that document? It's not even indexed in Google so far.

gnoway 11y ago
I used DuckDuckGo.

castillar76 11y ago

One might gently point out that the SubjectName in that cert is "C=US, O=Cisco Systems, CN=Cisco RXC-R2". Microsoft just seems to have abbreviated it to "RXC-R2".