Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent • Hacker News Board

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#141

Post by admax88q » Thu, Mar 28, 2019, 7:47 AM UTC

onion2k wrote: post #135

na85 wrote: post #131

Earlier quoted context omitted.

So whose fault is the cancerous heap of flaming dogshit that is nodejs, then? Some manager managed it into existence? No, it's the brainchild of an engineer. Somebody actually thought nodejs was a good idea. Face it, there are lots of really bad engineers out there.

I honestly envy the sort of person who can post something like this. Not liking nodejs is fine, but to extrapolate from "I don't like nodejs" to "Thousands of engineers at companies like Google are wrong and I am right" must require such a level of myopic, ignorant self-belief that is completely alien to me. I just find myself respecting other people's work too much, even if I don't like it.

> Thousands of engineers at companies like Google

That's an appeal to authority. It's also worth noting that nodejs is not a Google project and it is barely used internally at all. Only for small toy projects. Google uses python for scripting, or java for real servers.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#142

Post by [deleted] » Thu, Mar 28, 2019, 7:47 AM UTC

admax88q wrote: post #112

0xcde4c3db wrote: post #53

Earlier quoted context omitted.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…

[deleted]

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#143

Post by tomc1985 » Thu, Mar 28, 2019, 7:50 AM UTC

onion2k wrote: post #135

na85 wrote: post #131

Earlier quoted context omitted.

So whose fault is the cancerous heap of flaming dogshit that is nodejs, then? Some manager managed it into existence? No, it's the brainchild of an engineer. Somebody actually thought nodejs was a good idea. Face it, there are lots of really bad engineers out there.

I honestly envy the sort of person who can post something like this. Not liking nodejs is fine, but to extrapolate from "I don't like nodejs" to "Thousands of engineers at companies like Google are wrong and I am right" must require such a level of myopic, ignorant self-belief that is completely alien to me. I just find myself respecting other people's work too much, even if I don't like it.

I might be inclined to believe you, but node's ecosystem really is a trainwreck

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#144

Post by admax88q » Thu, Mar 28, 2019, 7:53 AM UTC

jodrellblank wrote: post #140

admax88q wrote: post #124

Earlier quoted context omitted.

You can always quit. Or force them to fire you for refusing to implement a non fix. In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix. Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this…

You suggest it was just one lone engineer being incompetent. Then you respond to downvotes with the non-sequitur "take some pride in your work" - are you suggesting pride is a fix for incompetence? What?

There are two points.

1) Any engineer involved in implementing this "fix" is incompetent.

2) If you are not incompetent and management tries to force you to implement this "fix" then you should take pride in your work and refuse to do it, even if it means quitting your job (or forcing the company to fire you).

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#145

Post by chii » Thu, Mar 28, 2019, 7:57 AM UTC

derpherpsson wrote: post #137

Cisco is crumbling under its own weight. This is a symptom of the rot in their management, and probably also a sign that they have hired too many incompetents. It probably also is a sign of the current age. After the recovery from the IT-bubble programming got really hot. Thus: Too many of the new programmers wants to be programmers because it pays well - not because they love their craft. So therefore we have a bunc…

> I want my socially maladept neckbeards and terminal junkies back plz.

the MBA types don't like these hacker types - personality clash and whatnots.

But the MBA types control the company from above, and the hacker types don't like to do management work. The result is obvious.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#146

Post by chii » Thu, Mar 28, 2019, 8:02 AM UTC

gonesilent wrote: post #96

lxe wrote: post #15

Earlier quoted context omitted.

Exactly. Hacking your client to use another user-agent or another IP address is illegal under CFAA. See Craigslist Inc. v. 3Taps Inc. etc...

So when I check desktop site in chrome I'm hacking?

Of course! So is right clicking and selecting inspect element to modify the page!

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#147

Post by ezoe » Thu, Mar 28, 2019, 8:02 AM UTC

zrm wrote: post #125

anyfoo wrote: post #71

Earlier quoted context omitted.

Even without --user-agent, you can still pipe 'echo -e "GET ...\rnHost: ... "' through nc, or even telnet. Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".

> Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:". Unfortunately it is also possible to do this using file redirection or to write a new program that will make a TCP connection and send arbitrary data through it, making it necessary to do the same for all editors, compilers and interpreters. That sounds like a lot of wor…

Why stop there? The user can easily modify the kernel to disable such prevention measures for malicious usage.

We must have a regulation to require a hardware level detection and prevention features of curl which all hardware vendors must follow.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#148

Post by MertsA » Thu, Mar 28, 2019, 8:02 AM UTC

0x0000000 wrote: post #89

I have one of these routers :\ So far I'm unable to get the PoCs to work but that doesn't make me confident. I'm curious how pen testers reverse the .bin firmware download into source code, anyone have any insight there?

That's not source code, that's just a config file embedded into the firmware. For most firmware, it's a large binary file that often has different sections containing stuff like an OS kernel at one spot, a compressed archive somewhere else, etc. For the Cisco firmware in question in the middle of the firmware is a compressed CPIO archive (think of it like a zip file) that contains the root file system. The router is actually a small linux computer, inside that archive they have a config file for nginx (a web server) that tells nginx to return an error if it sees the user agent string for curl. There's no programming required here, just a trivial configuration change that masks the actual issue.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#149

Post by consp » Thu, Mar 28, 2019, 8:09 AM UTC

skrebbel wrote: post #122

0xcde4c3db wrote: post #53

Earlier quoted context omitted.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

Engineer Alice is the only person incompetent at their job in this conversation. If " irrepressibly existential sigh " is how you argue security with your bosses then maybe you're not senior enough to be in meetings like these. The Manager and QA Engineers here depend on the expertise of the engineers. If the engineers fail to communicate key details of the situation, then that's on them. Sure, the boss is still at f…

> The Manager and QA Engineers here depend on the expertise of the engineers.

Both should be sufficiently competent and knowledgeable to know this is a terrible idea, especially in the long run. Otherwise they do not understand the task they have been given. So no, Alice is not the only incompetent one here.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#150

Post by adrianN » Thu, Mar 28, 2019, 8:13 AM UTC

admax88q wrote: post #124

astrobe_ wrote: post #123

Earlier quoted context omitted.

You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.

You can always quit. Or force them to fire you for refusing to implement a non fix. In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix. Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this…

If there were actual accountability, software engineers would have a much better lever against management. For some software this is case. If you write safety critical software you can be held personally responsible for accidents. In those industries engineer pushback is much more effective.