If a Cisco crypto key was found in a Huawei switch, the media response would be very different.
Yep, and you'd likely see Bloomberg running it as a feature special.
I understood this reference
Huawei cryptographic keys embedded in Cisco’s firmware
31–38 of 38 posts
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#32If a Cisco crypto key was found in a Huawei switch, the media response would be very different.
No it wouldn't - at least to anyone with a triple digit IQ, and capable of effectively digesting a story before drawing a conclusion.
(Thank god our judicial system doesn't have the attention-span of an ADHD child.)
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#33Tired: Cisco routers have U.S. backdoors! Fired: Huawei routers have Chinese backdoors! Inspired: Cisco routers have Huawei backdoors! Reality is often stranger than fiction...
No backdoor this time, but a private (!) key. No idea what the private key is used for, but doesn't look like you can use it to log into the device.
Private key would be used to decrypt traffic, most likely. (if we're speculating about malicious use possibilities)
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#34So, in summary: 1. Cisco used Open Source software (OpenDaylight), without sanitizing publicly available (GitHub) certificates and private keys. 2. The screenshot in the source article mentions the subject of the certificate. Yet, the text refers to it as the signing party. 3. Somebody used a business name and an email address that is associated to Huawei, to generate a certificate. Observations: - Regarding (1): If…
From what I read, it sounds like Cisco put a file from public github into the IOT firmware's /root/.ssh directory. Something is very wrong with that firmware generating process. Why would anyone do that? Even accidentally?
There is a nice talk on youtube (sorry, tried to find a link and couldn't in less than 30 seconds) that discusses Cisco's firmware build... "process". Rest assured, "very wrong" is a nice description; allegedly, we're talking things like "random engineer builds firmware image from local checkout using personal build scripts and uncommitted code, and if it appears to work then it gets shipped to customers, either at large or on a case-by-case basis". Honestly, the presence of additional random files is completely unsurprising.
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#35seeing this more and more... open source projects pulled in as dependencies without auditing, and causing a security issue. I predict this is going to become more and more of an issue over the next couple of years, and provoke some drastic changes to the way we do open-source software. What those changes are, I don't know...
> years, and provoke some drastic changes to the way we do open-source software.
I object to this phrasing because it makes it sounds like the FOSS software is at fault. The problem is that companies are pulling random code off the internet and sticking it in products without auditing or understanding it, so the only solution needed is for companies to actually pay attention to what they're using/shipping (possibly by holding them liable when people are paying for their products, but that could have side effects). In particular, pretty much every FOSS license I've ever seen explicitly says that the software is offered without any claim that it's good/usable/safe, and you can't limit that limitation of liability without seriously screwing up the whole FOSS ecosystem.
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#36Re: Huawei cryptographic keys embedded in Cisco’s firmware
#37Earlier quoted context omitted.
I understood this reference
Please enlighten me
Bloomberg ran a story [1] about a supply chain attack against apple, amazon, and others. It made big headlines, but evidence never emerged. It is now generally believed that the story was false.
No one has found these chips and shown them, and the likes of apple and amazon have issued very direct denials (that would be very clear securities fraud if they were false). Much more direct than statements by corporations usually are.
[1] https://www.bloomberg.com/news/articles/2018-10-04/the-big-h...
Re: Huawei cryptographic keys embedded in Cisco’s firmware
#38seeing this more and more... open source projects pulled in as dependencies without auditing, and causing a security issue. I predict this is going to become more and more of an issue over the next couple of years, and provoke some drastic changes to the way we do open-source software. What those changes are, I don't know...
> years, and provoke some drastic changes to the way we do open-source software. I object to this phrasing because it makes it sounds like the FOSS software is at fault. The problem is that companies are pulling random code off the internet and sticking it in products without auditing or understanding it, so the only solution needed is for companies to actually pay attention to what they're using/shipping (possibly b…
I totally understand and agree with that. But we don't live in a perfect world where people do the things they're supposed to do. And there are lots of developers out there who will pull in a malign FOSS library, then blame everyone else when it does exactly what the code said it would do.
Just like every other avenue of life, we're going to have to dumb down what we do so that idiots don't hurt themselves.