A simple command allows the CIA to commandeer vulnerable Cisco switches
1–10 of 90 posts
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#2Thank god only the CIA knows the "simple command".
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#3Critical vulnerabilities in Cisco products that the CIA can exploit?
"Cisco vice president of services Mike Quinn, a former CIA operations officer, ..." [0]
"... Cisco's recent acquisition of In-Q-Tel-backed security company ThreatGRID ..." [1]
"After retiring with 30+ years of service from the Agency, I spent several years as adviser to Cisco System’s Chief Security Officer, and I found Cisco was doing great work; they’re one of the backbones of the internet." [2]
Imagine that.
[0] http://www.networkworld.com/article/2223473/data-center/cisc...
[1] http://www.networkworld.com/article/2358453/security/cisco-p...
[2] https://www.forbes.com/sites/realspin/2012/10/12/what-do-for...
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#4"Computer Scientists Hate Him"
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#5Thank god only the CIA knows the "simple command".
It was probably that simple on purpose, knowing Cisco's ties to intelligence agencies.
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#6Shameless plug for my old buddy Ang's product, Symbiote Defense. Definitely watch the DEFCON talk about this.
https://www.redballoonsecurity.com/ https://www.youtube.com/watch?v=HyEiMyyrfyE
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#7ArsTechnica article as of this posting:
>Cisco Systems said that more than 300 models of switches it sells contain a critical vulnerability that allows the CIA to use a simple command to remotely execute malicious code that takes full control of the devices. There currently is no fix.
Text on Cisco Support Site linked on ArsTechnica:
>This vulnerability affects the following Cisco devices when running a vulnerable Cisco IOS software release and configured to accept incoming Telnet connections: [Models list]
Put aside for a moment the 'desireability' of the outcome, but from what I gather on Cisco's site, by turning off incoming Telnet connections, the vulnerability can be fixed. I'm rather confused about this.
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#8ArsTechnica article as of this posting: > Cisco Systems said that more than 300 models of switches it sells contain a critical vulnerability that allows the CIA to use a simple command to remotely execute malicious code that takes full control of the devices. There currently is no fix. Text on Cisco Support Site linked on ArsTechnica: > This vulnerability affects the following Cisco devices when running a vulnerable…
Disabling the service is a way to protect you from the vulnerability, but it is not a fix for the vulnerability. A fix for the vulnerability would allow you to continue using the service.
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#9"We are shocked that the CIA has the ability to use the command that we left in our firmware for them..."
Re: A simple command allows the CIA to commandeer vulnerable Cisco switches
#10ArsTechnica article as of this posting: > Cisco Systems said that more than 300 models of switches it sells contain a critical vulnerability that allows the CIA to use a simple command to remotely execute malicious code that takes full control of the devices. There currently is no fix. Text on Cisco Support Site linked on ArsTechnica: > This vulnerability affects the following Cisco devices when running a vulnerable…
Disabling the service is a way to protect you from the vulnerability, but it is not a fix for the vulnerability. A fix for the vulnerability would allow you to continue using the service.
Right? We have issued a fix for the router - simply unplug all network cables from the router, and you are no longer vulnerable.