But Huawei...
Cisco Nexus 9000 Switches Allow SSH As Root
41–50 of 113 posts
Re: Cisco Nexus 9000 Switches Allow SSH As Root
#42Earlier quoted context omitted.
A backdoor to me suggests an intentional loophole through a level of security. A bug that does the same is severe, but isn't intentional. At least that's my reading.
But any competently inserted intentional backdoor is going to be indistinguishable from a mistake. If Cisco had some SecretFBIChinaBackdoor() function somewhere the backlash would be way way worse (or at least an unknown). Whereas at this point it's abundantly clear that serious "non intentional" security vulnerabilities in networking hardware basically go ignored by the market.
>But any competently inserted intentional backdoor is going to be indistinguishable from a mistake.
Maybe, but without proof it's still just speculation. Real bugs do occur often, and sometimes in sensitive areas.
I understand wanting to be vigilant. In both assuming malice and assuming human error though, you're still forced to make an assumption.
Re: Cisco Nexus 9000 Switches Allow SSH As Root
#43If a compamy as big as Cisco can screw this kind of thing so badly, the future of IoT looks bleak.
Cisco hasn't had a good reputation for awhile IMO.
Re: Cisco Nexus 9000 Switches Allow SSH As Root
#44I don't own nor have I read the manual of one of these, and there's not much in the way of details on that page, but isn't this more like "use the factory-supplied default key to get in for the first time, then change it to your own"?
Re: Cisco Nexus 9000 Switches Allow SSH As Root
#45Re: Cisco Nexus 9000 Switches Allow SSH As Root
#46If a compamy as big as Cisco can screw this kind of thing so badly, the future of IoT looks bleak.
You know what they say: the S in IoT stands for security.
Re: Cisco Nexus 9000 Switches Allow SSH As Root
#47Earlier quoted context omitted.
But any competently inserted intentional backdoor is going to be indistinguishable from a mistake. If Cisco had some SecretFBIChinaBackdoor() function somewhere the backlash would be way way worse (or at least an unknown). Whereas at this point it's abundantly clear that serious "non intentional" security vulnerabilities in networking hardware basically go ignored by the market.
>But any competently inserted intentional backdoor is going to be indistinguishable from a mistake. Maybe, but without proof it's still just speculation. Real bugs do occur often, and sometimes in sensitive areas. I understand wanting to be vigilant. In both assuming malice and assuming human error though, you're still forced to make an assumption.
You're not forced to make an assumption, you can just be honest and say you don't know. There's too many comments in this thread effectively saying "it looks unintentional, so it's unintentional".
Re: Cisco Nexus 9000 Switches Allow SSH As Root
#48I surely can't be the only one who sees open down to the hardware replacements as the only solution to this type of problems.
Re: Cisco Nexus 9000 Switches Allow SSH As Root
#49What product segment is this, what kind of organizations are likely have them?
Also, link to Cisco's own advisory: https://tools.cisco.com/security/center/content/CiscoSecurit...
Re: Cisco Nexus 9000 Switches Allow SSH As Root
#50Earlier quoted context omitted.
It allows anyone who knows the default SSH key pair to login as root. How is that not a backdoor? Backdoor definition: "A backdoor is a method, often secret, of bypassing normal authentication in a computer system."
People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.
And what do you think this was? Virtually all router/networking devices have some kind of "hardcoded account" (read:backdoor) and this is only slowly changing. I believe the EU is going to ban the practice soon.