So those were just files hanging around in the image, not used by anything.
To play devils advocate: this is what Cisco says, not result of an independent analysis :-)
Huawei cryptographic keys embedded in Cisco’s firmware
11–20 of 38 posts
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#12The key was in a test folder of an open source project. Shouldn't get into a production build but doesn't really matter if it did. This is just sloppy work by Cisco.
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#13Tired: Cisco routers have U.S. backdoors! Fired: Huawei routers have Chinese backdoors! Inspired: Cisco routers have Huawei backdoors! Reality is often stranger than fiction...
No reality is usually boring. It came from an opensource github repo. It was an oversight.
Dial down the conspiracy-factor brother.
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#14Earlier quoted context omitted.
What "media response" are you seeing, and where? From the article: > Given the ongoing political controversy around Huawei, we did not want to speculate any further [..] According to Cisco, no attack vectors have been identified What's wrong with that, and how would it be "different" if it was the other way around?
I'm pretty sure the other way around it would be a foregone conclusion that Huawei stole IP from Cisco.
Likely, but that didn't happen. And "the other way around" could also mean what Chinese media would write about Cisco private keys found in Huawei gear.
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#15So, in summary:
1. Cisco used Open Source software (OpenDaylight), without sanitizing publicly available (GitHub) certificates and private keys.
2. The screenshot in the source article mentions the subject of the certificate. Yet, the text refers to it as the signing party.
3. Somebody used a business name and an email address that is associated to Huawei, to generate a certificate.
Observations:
- Regarding (1): If any finger pointing or suggesting should be done here, it should not be at anyone but Cisco.
- Regarding (2): Either the original source article contains incorrect information, or these certificates were self-signed, which makes any information supplied in the certificate arbitrary and meaningless.
- Regarding (2): If the information is incorrect, and the certificate was signed by an accredited party, the person who put this on GitHub sure made a stupid mistake, rendering this private key essentially useless (to anyone, Huawei and Cisco included).
- Regarding (3), just because somebody uses (either real of fake) business information to generate a certificate, does not indicate that said business had any involvement whatsoever. Not unless the certificate is signed by a party that guarantees the vetting of that info.
Final thought: The title with "Huawei cryptographic keys" appears to be very misleading at best, simple incorrect more likely. I do not see the link between Huawei and these keys, other than somebody using arbitrary information to generate a (self-signed) certificate from a private key.
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#16seeing this more and more... open source projects pulled in as dependencies without auditing, and causing a security issue.
I predict this is going to become more and more of an issue over the next couple of years, and provoke some drastic changes to the way we do open-source software. What those changes are, I don't know...
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#17seeing this more and more... open source projects pulled in as dependencies without auditing, and causing a security issue. I predict this is going to become more and more of an issue over the next couple of years, and provoke some drastic changes to the way we do open-source software. What those changes are, I don't know...
While that observation might be true (I doubt it will change Open Source, nor is it a new problem), what's the security issue in this particular case?
Cisco adding an already compromised (it's on GitHub) private key to their firmware, which sure isn't a smart thing to do. But the only security issue I could see here is that somebody could use it to create a "secure" outbound connection from a Cisco device, that just isn't secure at all (because anyone has access to the private key).
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#18So, in summary: 1. Cisco used Open Source software (OpenDaylight), without sanitizing publicly available (GitHub) certificates and private keys. 2. The screenshot in the source article mentions the subject of the certificate. Yet, the text refers to it as the signing party. 3. Somebody used a business name and an email address that is associated to Huawei, to generate a certificate. Observations: - Regarding (1): If…
Creating a private key for test purposes and putting it in a test folder of an open source project is a quite reasonable thing to do. I am guessing the email-address is there because the tool used to create the certificate asked for it.
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#19So, in summary: 1. Cisco used Open Source software (OpenDaylight), without sanitizing publicly available (GitHub) certificates and private keys. 2. The screenshot in the source article mentions the subject of the certificate. Yet, the text refers to it as the signing party. 3. Somebody used a business name and an email address that is associated to Huawei, to generate a certificate. Observations: - Regarding (1): If…
From what I read, it sounds like Cisco put a file from public github into the IOT firmware's /root/.ssh directory.
Something is very wrong with that firmware generating process.
Why would anyone do that? Even accidentally?
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#20So, in summary: 1. Cisco used Open Source software (OpenDaylight), without sanitizing publicly available (GitHub) certificates and private keys. 2. The screenshot in the source article mentions the subject of the certificate. Yet, the text refers to it as the signing party. 3. Somebody used a business name and an email address that is associated to Huawei, to generate a certificate. Observations: - Regarding (1): If…
[deleted]