Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

61–70 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#61

Post by dvhh »

StavrosK wrote: post #13
teraflop wrote: post #10

Earlier quoted context omitted.

I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this kind of attack. A better fix would be to just drop all incoming IPv4 packets that have the "evil" bit set. ( https://www.ietf.org/rfc/rfc3514.txt ) Extending this protection to IPv6 is left as an exercise for the reader.

Ah, but what about packets that aren't evil, just gullible and manipulated by some third party?

Then add a "tainted by evil" flag to the ipv7 spec, or better, just add a "pure" flag to future ip spec.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#62

Post by anyfoo »

0xcde4c3db wrote: post #53
danso wrote: post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

> Manager: And we can just prevent it with an extra regex rule in the front end code? > Engineer Alice: ... Yes. irrepressibly existential sigh

The answer is "no", though. This exchange sounds like the decision was between "fixing it cleanly" and "fixing it with a hack", which is roughly equivalent with fixing the problem at the expense of technical debt. But this change does not fix the problem at all.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#63

Post by wincy »

StavrosK wrote: post #13
teraflop wrote: post #10

Earlier quoted context omitted.

I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this kind of attack. A better fix would be to just drop all incoming IPv4 packets that have the "evil" bit set. ( https://www.ietf.org/rfc/rfc3514.txt ) Extending this protection to IPv6 is left as an exercise for the reader.

Ah, but what about packets that aren't evil, just gullible and manipulated by some third party?

Well if you’d read the RFC it’s obvious it’s your routers responsibility to flag those bits as evil. And if you’re using heuristic intrusion detection systems you need to do flag each bit as evil 50% of the time. It’s good we have such amazing protections in place.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#64

Post by anyfoo »

frjalex wrote: post #55
stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

libcurl is open source, I would imagine it'd not be difficult to make it "lie."

Someone who also did not get the joke is going to read your comment, and suggest that libcurl being closed source somehow fixes the problem.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#65

Post by ReptileMan »

stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

And it is also very good that regexes are simple, unambiguous, easy to debug and their engines are heavily scrutinized that no code execution/undefined behavior is possible.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#66

Post by realusername »

mehrdadn wrote: post #45
realusername wrote: post #42

Earlier quoted context omitted.

the could be accomplished just by having User-Agent: mobile, all the other data in the user-agent are useless for this purpose.

Well at least we acknowledged there's some utility. Now consider that mobile devices are different as well..

The current user agent does not give you much insight about what type of mobile device you have anyway, especially on Android.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#67

Post by realusername »

jrochkind1 wrote: post #50
realusername wrote: post #42

Earlier quoted context omitted.

the could be accomplished just by having User-Agent: mobile, all the other data in the user-agent are useless for this purpose.

There is presumably some way, at least hypothetically, to fix the mess that User-Agent has become. (Everybody is 'Mozilla' now! And yet somehow a unique snowflake 'Mozilla' that lets you be tracked...) But it's not quite that. It's not that a device is "mobile" instead of "stationary" that matters. It's maybe that it's a touch screen. It's maybe that it's a small screen. (With an especially uneven aspect ratio?) Mayb…

All of those small differences of mobile devices are better served by media queries I personally think. You could replace "mobile" in my example by "small-screen" if you prefer.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#68

Post by ducttapecrown »

mehrdadn wrote: post #30
MiddleEndian wrote: post #20

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

They help you figure out if a user agent wants a mobile view of a page without Javascript... which is pretty useful.

So instead of sending a user agent, send only the page ratio!!

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#70

Post by wyldfire »

StavrosK wrote: post #27
jniedrauer wrote: post #21

Earlier quoted context omitted.

I think you should have added a /s tag... some people don't get jokes unless you hit them over the head with it.

I will never stoop so low as to telegraph my own joke.

Then you must encounter Poe's Law frequently....?
Post reply on HN