Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent • Hacker News Board

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#71

Post by anyfoo » Thu, Mar 28, 2019, 2:26 AM UTC

StavrosK wrote: post #9

beachy wrote: post #4

Earlier quoted context omitted.

Eh? Software can do exactly that.

How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?

Even without --user-agent, you can still pipe 'echo -e "GET ...\rnHost: ... "' through nc, or even telnet.

Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#72

Post by koolba » Thu, Mar 28, 2019, 2:39 AM UTC

StavrosK wrote: post #35

MiddleEndian wrote: post #20

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

I vote we change all user agents to just "curl".

Might as well save 3 bytes and just call use “c”.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#73

Post by duxup » Thu, Mar 28, 2019, 2:41 AM UTC

danso wrote: post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

I've had some visibility to big networking equipment manufacturers... the security or even stability on their web interfaces is terrible. It's like a strange rule of thumb for all the networking equipment manufacturers. If you have choice, disable the web interface.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#74

Post by rndgermandude » Thu, Mar 28, 2019, 2:45 AM UTC

altmind wrote: post #52

MiddleEndian wrote: post #20

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

Considering recent chrome, firefox user agent contains id string of almost every browser in existence, this is so true: Mozilla/5.0 (...) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

You just wait for Edge-based-on-Chromium's User-Agent :D

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#75

Post by adrr » Thu, Mar 28, 2019, 2:45 AM UTC

justinjlynn wrote: post #29

baggy_trough wrote: post #25

Earlier quoted context omitted.

Rubbish. They are incredibly useful for debugging.

There are better solutions available than hanging functionality on unreliable vestigial bits and pieces that shouldn't be there anyway which, because others abuse the functionality, you can't trust to be correct for debugging purposes.

99% of the traffic has the correct user-agent which is useful in tracking down issues that are browser specific. The other 1% will just get ignored as noise. And it's not like we can't tell what type of browser they are using with browser specific objects that we can pull from javascript. We just can't infer the version of the browser which is critical for debugging issues.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#76

Post by earenndil » Thu, Mar 28, 2019, 2:47 AM UTC

jasonhansel wrote: post #28

Camillo wrote: post #24

I think this is called "Test Driven Development". /s

Actually, this sort of superficial fix can be a result of (overzealous) TDD.

Tests must not be robust enough, then.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#77

Post by amalcon » Thu, Mar 28, 2019, 2:52 AM UTC

0xcde4c3db wrote: post #53

danso wrote: post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

I've been Engineer Alice before (not with a security issue, but a pretty bad systems issue). In case anyone is ever in that situation, here are some more productive replacements for that existential sigh (in that they sometimes work). Choose the one most suited to manager's biases. The cliches are important: think of it as giving manager an easy way to explain it to their manager.

> Yes, but that would only help with this specific case. The proper fix would ensure that we don't see a similar issue tomorrow. We don't want to prepare for yesterday's battle.

> Yes, but the extra regex rule would be new code, which would need its own maintenance in perpetuity. Fixing it properly would let us remove the existing code. Removing code is the most efficient thing an engineer can do, and will save man-hours in the long run.

> Yes, but the extra regex rule has worse runtime performance than the proper fix. [Performance is our big competitive advantage | We don't want to fall behind in performance | We are already behind in performance]. We don't want to create a customer-visible performance regression.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#78

Post by xnaas » Thu, Mar 28, 2019, 2:56 AM UTC

rndgermandude wrote: post #74

altmind wrote: post #52

Earlier quoted context omitted.

Considering recent chrome, firefox user agent contains id string of almost every browser in existence, this is so true: Mozilla/5.0 (...) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

You just wait for Edge-based-on-Chromium's User-Agent :D

Per a buddy who is using said Edgium (Chromium-based Edge): https://i.imgur.com/p6ZMoJY.png

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#79

Post by pdkl95 » Thu, Mar 28, 2019, 3:10 AM UTC

baggy_trough wrote: post #25

MiddleEndian wrote: post #20

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

Rubbish. They are incredibly useful for debugging.

edit: sorry, accidentally submitted early

So what. Removing one of the largest sources entropy available for fingerprinting users is important. We shouldn't maintain the terrible long-term effects[1] of tracking everything just to help you have an easier time debugging.

[1] http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and...

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#80

Post by philpem » Thu, Mar 28, 2019, 3:11 AM UTC

coldacid wrote: post #56

0xcde4c3db wrote: post #53

Earlier quoted context omitted.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

Bob is either a brown-noser or a complete turncoat. Don't be like Bob.

Bob is probably an engineer with twenty years experience, who's been thoroughly ground down by management and peer power-plays and has realised that the best solution is to keep your head below the parapets!