Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A simple command allows the CIA to commandeer vulnerable Cisco switches

arstechnica.com

Post reply on HN
Print view View original

61–70 of 90 posts

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#61

Post by cheez »

linkregister wrote: post #11
rl3 wrote: post #3

Critical vulnerabilities in Cisco products that the CIA can exploit? "Cisco vice president of services Mike Quinn, a former CIA operations officer, ..." [0] "... Cisco's recent acquisition of In-Q-Tel-backed security company ThreatGRID ..." [1] "After retiring with 30+ years of service from the Agency, I spent several years as adviser to Cisco System’s Chief Security Officer, and I found Cisco was doing great work; t…

1. The vulnerability was probably exploited before the CIA guy joined Cisco. The Vault 7 cache contains some seriously legacy docs. 2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around? 3. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community. 4. Telnet options are pretty arcane. It seems li…

> 2. Why would the ex-CIA guy hurt his current employer to help his former? Don't people do it the other way around?

When you get into the big wide world of making billions of dollars, you'll find that people are more than willing to throw you a bone long after you're gone to make sure you're still invested.

I've seen this first hand (unfortunately/fortunately, not the recipient of said bone).

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#62

Post by cmdrfred »

ue_ wrote: post #59
cmdrfred wrote: post #58

Earlier quoted context omitted.

You seem to not be a fan of capitalism. Do you live in China, Cuba, Vietnam, Laos or North Korea? If not, why not?

>China, Cuba, Vietnam These are capitalist countries, in which wage labour is the primary way by which workers sustain themselves; property is privately owned (and yes, the government can privately own property). >North Korea North Korea is an ethno-nationalist dictatorship run by a hereditary monarchy. What's your point?

Others disagree with your sentiment: http://www.thenewstrack.com/top-5-communist-countries-in-the...

Where is an example of a good system then?

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#63

Post by ue_ »

cmdrfred wrote: post #62
ue_ wrote: post #59

Earlier quoted context omitted.

>China, Cuba, Vietnam These are capitalist countries, in which wage labour is the primary way by which workers sustain themselves; property is privately owned (and yes, the government can privately own property). >North Korea North Korea is an ethno-nationalist dictatorship run by a hereditary monarchy. What's your point?

Others disagree with your sentiment: http://www.thenewstrack.com/top-5-communist-countries-in-the... Where is an example of a good system then?

People disagreeing with me does not mean that I'm wrong. Communism is defined as a stateless, classless and monelyess and anarchistic society in which peolpe are not paid with wages for work. Even in Socialism, the means of production are owned by the workers. None of the countries in this post have either of these qualities.

However they all exhibit the fundamental properties of capitalism: the primacy of wage labour, private ownership of capital and the means of production, and production is for exchange value to be maximised over use value.

I am an anarcho-Communist. I believe in the demolishing of the state and all unjustified hierarchical relations, including but not limited to the government and the bourgeoisie, to advance toward a society in which the means of production are collectively owned by the workers. Distributed networks of councils of workers, each of which implementing direct democracy to decide what is made and in what quantity. The workers take home the products of their labour, or agree to have them distributed to those who are unable to work, again via direct democracy.

My system is the abolishment of exploitation of the workers and with it the system of oppression aided by capitalism's power structures, including misogyny, racism, homophobia etc.

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#64

Post by cmdrfred »

ue_ wrote: post #63
cmdrfred wrote: post #62

Earlier quoted context omitted.

Others disagree with your sentiment: http://www.thenewstrack.com/top-5-communist-countries-in-the... Where is an example of a good system then?

People disagreeing with me does not mean that I'm wrong. Communism is defined as a stateless, classless and monelyess and anarchistic society in which peolpe are not paid with wages for work. Even in Socialism, the means of production are owned by the workers. None of the countries in this post have either of these qualities. However they all exhibit the fundamental properties of capitalism: the primacy of wage labou…

Anarchism - belief in the abolition of all government and the organization of society on a voluntary, cooperative basis without recourse to force or compulsion.

Communism - a political theory derived from Karl Marx, advocating class war and leading to a society in which all property is publicly owned and each person works and is paid according to their abilities and needs.

If there is no government, who distributes things based on needs? Why don't I just kill you and take everything you own? Communism is total government, Anarchism is no government. Its oil and water.

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#65

Post by tptacek »

linkregister wrote: post #44
duncan_bayne wrote: post #37

Earlier quoted context omitted.

> I know several of their key people, one of whom has a framed Che poster. They're not the type. :) Perhaps a bit OT, but you're dead wrong about Che. He was a mass murderer, and I'd treat someone with a framed picture of him with the same suspicion I'd reserve for someone with a Stalin or Hitler portrait. http://www.therealcuba.com/?page_id=32

The point he was making is that Che isn't a widely admired figure in U.S. intelligence circles.

Yes. I'm left-of-center (through probably right-of-HN as I perceive it) and also find Che to be an odious figure.

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#66

Post by rblatz »

cmdrfred wrote: post #64
ue_ wrote: post #63

Earlier quoted context omitted.

People disagreeing with me does not mean that I'm wrong. Communism is defined as a stateless, classless and monelyess and anarchistic society in which peolpe are not paid with wages for work. Even in Socialism, the means of production are owned by the workers. None of the countries in this post have either of these qualities. However they all exhibit the fundamental properties of capitalism: the primacy of wage labou…

Anarchism - belief in the abolition of all government and the organization of society on a voluntary, cooperative basis without recourse to force or compulsion. Communism - a political theory derived from Karl Marx, advocating class war and leading to a society in which all property is publicly owned and each person works and is paid according to their abilities and needs. If there is no government, who distributes t…

That why it's the best system to support in Internet forums! You can just pick the parts from each that work for the argument you are making. Since they are polar opposites you have a lot of ground to pick ideals from. Thus winning the argument.

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#67

Post by tptacek »

rl3 wrote: post #36
tptacek wrote: post #26

Earlier quoted context omitted.

Cisco buying an In-Q-Tel-funded company is about the most banal observation you can make. In-Q-Tel is one of the more prominent investors in network and information security companies (IIRC, that's their founding charter!) and Cisco is the bizdev endgame strategy for most VC-funded security product companies. I doubt ThreatGrid is the only IQT company Cisco has bought. I am as certain they're not a CIA plant inside C…

> I am as certain they're not a CIA plant inside Cisco as I am of anything else in my perceived reality ... Of course they aren't. All I'm saying is if you have a company that has a routine acquisition deal flow from the CIA's venture capital arm, that there's probably healthy working relationships there.

By that logic, In-Q-Tel is a stroke of genius, because they've also built "healthy working relationships" with Network Appliance, IBM, Amazon, EMC, Microsoft, Intel, Oracle, Google, and Nokia.

I think you just can't read anything into In-Q-Tel involvement with a company.

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#68

Post by Johnny555 »

walrus01 wrote: post #23

If you're exposing telnet to the public internet on anything you need to rethink whether you're competent to run internet infrastructure.

I doubt that many Cisco shops expose telnet to the public internet, but I bet plenty of them have it exposed on a "secure" internal network since they know that no outside attacker can possibly reach it.

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#69

Post by ue_ »

cmdrfred wrote: post #64
ue_ wrote: post #63

Earlier quoted context omitted.

People disagreeing with me does not mean that I'm wrong. Communism is defined as a stateless, classless and monelyess and anarchistic society in which peolpe are not paid with wages for work. Even in Socialism, the means of production are owned by the workers. None of the countries in this post have either of these qualities. However they all exhibit the fundamental properties of capitalism: the primacy of wage labou…

Anarchism - belief in the abolition of all government and the organization of society on a voluntary, cooperative basis without recourse to force or compulsion. Communism - a political theory derived from Karl Marx, advocating class war and leading to a society in which all property is publicly owned and each person works and is paid according to their abilities and needs. If there is no government, who distributes t…

>Communism is total government, Anarchism is no government. Its oil and water.

This is false. Communism leads to a stateless society, which is known as anarchism, i.e without rulers. Where do you get your information that Communism has a government?

> each person works and is paid according to their abilities and needs.

Wrong! Workers are not paid within Communism, they collectively own the means of production and decide what to do with the products. Payment is a form of wage, and Communism abolishes wage labour completely. Communism is also moneyless.

"All Socialists are agreed that the political state, and with it political authority, will disappear as a result of the coming social revolution, that is, that public functions will lose their political character and will be transformed into the simple administrative functions of watching over the true interests of society."

-- Freidrich Engels, one of the founders of Marxism (https://www.marxists.org/archive/marx/works/1872/10/authorit...)

>If there is no government, who distributes things based on needs?

The workers collectively decide in the form of democratic voluntary participation councils whether anything should be distributed, to whom it will be distributed, how much is produced, etc; ideally these would be distributed, and several such councils exist all connected to each other, but none with authority over the other. In Communism, goods are not necessarily distributed, the workers receive the goods. However with the state of automation and abundance of resources (all resources are accessible collectively by the workers) sufficient can be produced to sustain others. However again, this is the collective and democratic choice of the workers. The kind of democracy I am talking about is not representative, it is direct or delegatory, and if delegatory the delegates are subject to instant recall.

>Why don't I just kill you and take everything you own?

Why would you steal in a society in which you yourself, a worker, collectively own the automation and tools to make what you want for yourself? Of all the offences, why would you choose theft? Within anarchism, how to deal with a violent offender would probably be a democratic decision. If you're interested in the crime question (which is a little problematic because 'crime' is defined by the state) then here is some reading:

https://theanarchistlibrary.org/library/scott-of-the-insurge...

https://theanarchistlibrary.org/library/robert-anton-wilson-...

http://anarchy101.org/2784/would-anarchist-society-with-crim...

https://www.reddit.com/r/DebateAnarchism/comments/44n3zi/how...

https://www.reddit.com/r/DebateAnarchism/comments/3uhbfv/how...

https://www.reddit.com/r/Anarchy101/comments/2ph8uw/how_woul...

Re: A simple command allows the CIA to commandeer vulnerable Cisco switches

#70

Post by peterwwillis »

6stringmerc wrote: post #38
chousuke wrote: post #19

Earlier quoted context omitted.

The article kind of makes it sound like telnet is somehow necessary and that disabling it hasn't been a best practice for years. Maybe there are still old devices that don't support SSH and you literally have no option, but really, what other reason is there to have telnet enabled?

That's what I was thinking about. On the Cisco support site Telnet gets barely a mention. It is apparently not the flagship feature of these switches and whatnot. Okay maybe it's customary to leave it open but there's a lot of lazy practices that result in bad security, not just headline "vulnerabilities" that affect - gasp - 300+ models! So, basically I think Ars Technica's sub-par quality strikes again, in that a t…

No, that is a workaround. Telnet is still broken until they patch the security hole.
Post reply on HN