Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Nexus 9000 Switches Allow SSH As Root

nvd.nist.gov

Post reply on HN
Print view View original

21–30 of 113 posts

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#21

Post by SquareWheel »

anbop wrote: post #19
tptacek wrote: post #3

This is a pretty egregiously editorialized title; what we know is that there's apparently an SSH keypair authorized on these devices, for which the private key is available on the device. That's a terrible, ugly vulnerability, but it's as likely due to stupidity as to malice. The right title is something like: CVS-2019-1804: Cisco Nexus 9000 Switches Allow SSH As Root.

What is a backdoor if not this?

A backdoor to me suggests an intentional loophole through a level of security. A bug that does the same is severe, but isn't intentional.

At least that's my reading.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#23

Post by snazz »

matthewaveryusa wrote: post #18
tptacek wrote: post #3

This is a pretty egregiously editorialized title; what we know is that there's apparently an SSH keypair authorized on these devices, for which the private key is available on the device. That's a terrible, ugly vulnerability, but it's as likely due to stupidity as to malice. The right title is something like: CVS-2019-1804: Cisco Nexus 9000 Switches Allow SSH As Root.

And plausible deniability is the #1 rule when being malicious. If you know enough to use an asymmetric key instead of a password, but not enough to think it's a good idea to leave the private key there, you're in a weird cross-section of expertise.

A broken script that turns a development build into a production/customer build could also be at fault, forgetting to delete the default key pair.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#24

Post by microwavecamera »

TallGuyShort wrote: post #9
sky_nox wrote: post #8

Earlier quoted context omitted.

It allows anyone who knows the default SSH key pair to login as root. How is that not a backdoor? Backdoor definition: "A backdoor is a method, often secret, of bypassing normal authentication in a computer system."

People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.

Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#26

Post by MaulingMonkey »

RL_Quine wrote: post #20
MaulingMonkey wrote: post #15

Earlier quoted context omitted.

Being the only keyholder reduces plausable deniability, so maybe.

The private key is on the shipped devices, from my reading.

Agreed.

I'm hypothesizing that you might do this, even with keys intended to be used as a back door, by shipping it on devices, you vastly increase the number of potential suspects for any backdoor abuse.

Continuing this train of thought - a hardcoded password is classic example of a backdoor, and just as "public" as including a private key.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#28

Post by bobbob1921 »

tptacek wrote: post #3

This is a pretty egregiously editorialized title; what we know is that there's apparently an SSH keypair authorized on these devices, for which the private key is available on the device. That's a terrible, ugly vulnerability, but it's as likely due to stupidity as to malice. The right title is something like: CVS-2019-1804: Cisco Nexus 9000 Switches Allow SSH As Root.

I agree , this is not a backdoor in the more commonly understood sense of the term , post-Snowden.

At the same time, your suggested "right title" doesn't seem too accurate either (imo).

When I see the term backdoor, I think of something done intentionally.

Maybe something like: Embeded unsecured credentials , allow attacker remote root ssh access

( it's actually much harder than I initially thought , to phrase)

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#30

Post by floatingatoll »

SquareWheel wrote: post #21
anbop wrote: post #19

Earlier quoted context omitted.

What is a backdoor if not this?

A backdoor to me suggests an intentional loophole through a level of security. A bug that does the same is severe, but isn't intentional. At least that's my reading.

Yes, that is the most commonly used to describe an “undocumented” access credential, regardless of why. This has been used for credentials that were added and forgotten, credentials that were added to permit unauthorized access later, and credentials that were added to permit authorized repairs more readily. These credentials were included in an “undocumented” (or “unpublished” might be more precise) manner and can be used to bypass security, so “backdoor” is correct.

This of course says nothing about whether its inclusion was due to intent, incompetence, and/or malice. (If the private key includes “Comment: hack the planet” then yeah it’s malice :)

Post reply on HN