81–90 of 113 posts
This is a nasty one! Sloppy in hindsight. There is one bright side to otherwise disgraceful incidents: All the customers running older versions are now forced to upgrade to the latest versions. The burden of supporting really old versions suddenly vanishes. Box vendors should really stop selling unmanaged boxes/solutions. In reality, customers end up buying service contracts anyway along with boxes. Instead, sell usa…
Users should no longer be allowed to own their own hardware? That'll be popular with both the hacker crowd and the high-security people.
What of devices that are never intended to be connected to the wider internet?
If you have the Cisco 9000 Series, patch them now! This SSH backdoor allows an unauthenticated, remote attacker to login as root.
Also you should have ACLs in place and VLAN segmentation (assuming their use as pure layer 2 devices) so that only certain authorized sections of the network are even able to reach things like the management ssh and SNMP daemons.
Earlier quoted context omitted.
I heard https://nvd.nist.gov/vuln/detail/CVE-2019-1804 is Cisco's ninth backdoor so far this year. Not ninth security problem total, ninth backdoor. The ninth security problem Cisco shipped intentionally . Meanwhile, the router that serves my office is from a company that's had fewer than nine security problems in the past ten years. Two, I think, but I confess I don't really keep count (ditto the nine above). The pr…
Can you tell us your vendor? We are moving offices, and it's time to change equipment, Been reading about but still haven't gotten a good list. The only thing i found is great micro tick for wifi routing/AP's
All of those will give you hardware that does the job and stays up, and provide uncomplicated upgrades for many years.
> Cisco Nexus 9000 Switches Allow SSH As Root
Earlier quoted context omitted.
And plausible deniability is the #1 rule when being malicious. If you know enough to use an asymmetric key instead of a password, but not enough to think it's a good idea to leave the private key there, you're in a weird cross-section of expertise.
A broken script that turns a development build into a production/customer build could also be at fault, forgetting to delete the default key pair.
I'll spin this around though: What would a high-quality plausibly deniable backdoor look like to you?
Earlier quoted context omitted.
Like any other network solutions vendor?
I heard https://nvd.nist.gov/vuln/detail/CVE-2019-1804 is Cisco's ninth backdoor so far this year. Not ninth security problem total, ninth backdoor. The ninth security problem Cisco shipped intentionally . Meanwhile, the router that serves my office is from a company that's had fewer than nine security problems in the past ten years. Two, I think, but I confess I don't really keep count (ditto the nine above). The pr…
Also the 9th they have fixed.
> Not ninth security problem total, ninth backdoor. The ninth security problem Cisco shipped intentionally.
How can you be sure it was intentional?
> Meanwhile, the router that serves my office is from a company that's had fewer than nine security problems in the past ten years.
How can you be sure? Did you audit all the source code yourself? Did you compile the source code yourself and are you running only binaries you compiled? Are you sure you can trust the compiler you used?
Or, are you assuming that, because there isn't a CVE, there isn't a vulnerability or security problem?
Fewer CVEs doesn't necessarily mean more secure, it may just mean less validation/testing etc.
But sure, it could mean more secure, it's just not a guarantee.