Cisco Nexus 9000 Switches Allow SSH As Root • Hacker News Board

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#111

Post by dngray » Fri, May 17, 2019, 3:31 AM UTC

bmalehorn wrote: post #66

madez wrote: post #48

I surely can't be the only one who sees open down to the hardware replacements as the only solution to this type of problems.

As a former Cisco employee, I can tell you why companies never want to open source their security-sensitive products: Pros of open sourcing a product: - fewer total number of vulnerabilities Cons of open sourcing a product: - more publicly-known vulnerabilities - less effort required to find new vulnerabilities The product might be more objectively secure, with more bug reports and more fixes. But it will be less pra…

Really what you're saying is that if you open source your product the degree of shittyness will be then obvious to everyone, and that security by obscurity keeps the managers happy because they think there is less work.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#112

Post by dngray » Fri, May 17, 2019, 3:38 AM UTC

TallGuyShort wrote: post #9

sky_nox wrote: post #8

Earlier quoted context omitted.

It allows anyone who knows the default SSH key pair to login as root. How is that not a backdoor? Backdoor definition: "A backdoor is a method, often secret, of bypassing normal authentication in a computer system."

People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.

> People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.

And considering you can never know if someone else knows about it, that means you can never know if it was a backdoor.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#113

Post by dngray » Fri, May 17, 2019, 3:39 AM UTC

microwavecamera wrote: post #24

TallGuyShort wrote: post #9

Earlier quoted context omitted.

People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.

Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product.

> Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product.

That someone might not be the company, it might be a developer.

It's entirely true that the company says it's not a backdoor, the developer says it's a mistake, but he/she was approached from an external organization.

Unless you can provide either way it's impossible to classify it as a backdoor or not.