Cisco plans to acquire cybersecurity firm Duo Security for $2.35B

Post by peterwwillis » Thu, Aug 02, 2018, 7:49 PM UTC

tptacek wrote: post #28

youdontknowtho wrote: post #4

I really hope that Duo survives this. Cisco isn't necessarily known for handling acquisitions well...or software...but who knows. Maybe it's the shot in the arm that many companies will need to move to token based auth. Lot's of enterprise IT departments take Cisco's word as divine. I have had some bad experiences with Cisco the company, but the devices have always been really good even if they lag behind some of the…

Cisco is essentially composed of nothing but acquisitions. That is what Cisco does. The reputation of Cisco's internal engineering culture used to be pretty grim. I never understood why any PM or lead would actually build something from a Cisco internal MRD, rather than jumping ship, building it privately, and selling it back to Cisco. I know of more than one person that did literally exactly that, successfully. But…

Post by trhway » Thu, Aug 02, 2018, 7:51 PM UTC

hb3b wrote: post #46

mtgx wrote: post #17

Earlier quoted context omitted.

Duo Beyond was a very smart move on their part, taking Google's enterprise security architecture and turning it into a third-party turnkey solution for enterprise customers. They did it before Cloudflare, too. I bet that is a big part of the reason why Cisco is paying so much now.

There isn't anything particularly innovative about Duo Beyond. Inspect the Docker containers and you'll see they simply rebranded simplesamlphp and wrote a custom ngx_http_auth_request_module handler for NGINX for their authenticated reverse proxy product. If Cisco paid 2 billion dollars for this, my mind is really blown. I'm struggling to figure out how they ended up at 2 billion because I don't see it in anything m…

Post by djrogers » Thu, Aug 02, 2018, 8:09 PM UTC

tialaramex wrote: post #49

dangoor wrote: post #45

Earlier quoted context omitted.

I know some of the Duo folks and they are serious security nerds and I don't think they would make this up. That said, I don't have any knowledge of the implementation. I did find this[1]: > Duo Push technology employs asymmetric encryption to sign and verify communications between Duo's servers and a smartphone running the Duo Push app I'm thinking this is saying something like they sign the contents of the push not…

Yeah, this doesn't help with a MITM because what happens is the victim is at Mallory's site thinking it's their real sign on site, Mallory is taking to their real sign on service. The victim types in real credentials, and says OK let's use Duo Push... Mallory now has their credentials and does Duo Push. The push is securely sent to the victim's phone, and they press OK because they really are trying to sign in. Mallo…

Post by geofft » Thu, Aug 02, 2018, 9:08 PM UTC

throwaway5752 wrote: post #8

Are they a cybersecurity company? I thought they were more about IAM. I realize this is the CNBC headline, but I am curious if Duo does something I was unaware of, like rev. engineering, pen. testing, etc. ps - congrats to Duo!

Post by paranoidrobot » Thu, Aug 02, 2018, 9:55 PM UTC

djrogers wrote: post #55

tialaramex wrote: post #49

Earlier quoted context omitted.

Yeah, this doesn't help with a MITM because what happens is the victim is at Mallory's site thinking it's their real sign on site, Mallory is taking to their real sign on service. The victim types in real credentials, and says OK let's use Duo Push... Mallory now has their credentials and does Duo Push. The push is securely sent to the victim's phone, and they press OK because they really are trying to sign in. Mallo…

Why would Duo Push allow Mallory's site to initiate a Duo Push for RealSite.com without either a shared secret or certificate validation? You present an obvious problem that has been solved securely many times over many products and act as if a group of IAM and 2fa professionals ignored or just hadn't thought of it before...