Cisco Products Have Backdoors

Cbs228 writes "A Cisco Security Advisory released yesterday admits that "A default username/password pair is present in all releases of the Wireless LAN Solution Engine (WLSE) and Hosting Solution Engine (HSE) software. A user who logs in using this username has complete control of the device. This username cannot be disabled." Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?"

Comments

Cisco's Life Lesson - Maybe not.

[Allen Zadr]

There is no doubt that this is the sort of thing that all of the so called "tin-foil hat" crowd has been warning us about for years.

I, for one, welcome the "I-told-you-so"s from our new paranoid overlords.

On a more serious point, and on the paranoid side, I'm sure Cisco is only releasing this information because an employee either threatened to leak this information, or was mis-using this information to his/her own gain...

However, if that's the case, wouldn't Cisco's fix simply change the password? I highly doubt that they will be embarassed enough to have learned a powerful life-lesson.

Re:Cisco's Life Lesson - Maybe not.

[On Lawn]

wouldn't Cisco's fix simply change the password? I highly doubt that they will be embarassed enough to have learned a powerful life-lesson.

Assuming the word has gotten out somehow, I'm not sure how they can change the password on all those systems that are currently out there, without raising the public awareness to the level that motivates them to apply the neccisary patches.

Re:Cisco's Life Lesson - Maybe not.

[Ithika]

"However, if that's the case, wouldn't Cisco's fix simply change the password?"

Doesn't sound like much of a fix to me... That barely comes into the category of workaround. Maybe issue-evasion.

I see a great many people buying hardware from Cisco's competitors in the near-future. Like right now. I wonder how long it'll be before we find out what the user/pass pairs are?

Re:Cisco's Life Lesson - Maybe not.

[big_knuckles]

However, if that's the case, wouldn't Cisco's fix simply change the password?

Your suggestion for Cisco's "fix" would still leave an account open to be exploited, just with a different password.

Re:Cisco's Life Lesson - Maybe not.

[erwinkarim]

actually, there's a reason for some company to provide a backdoor access.

there's some system that is so important that one cannot afford to loose the protected data. a client who messes up the system so badly, by purpose or accident, that the data is locked out, but the client don't want the data to be lost forever. crictical system like protein-folding or dna sequencing or airline reservation comes to mind.

what's the solution for this? backdoor access comes to mind. now it's just a question of the morallity of the company about using the back door access.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

Cisco has an evil backdoor that works (initially) at the ethernet level. You send several specially crafted frames to a MAC on the local segment or special packets to the outside interface and the unit will open up a back connection to Cisco. The PIX and ACLs in their router products will not log these or otherwise alert you to their existence. Once the connection is made, Cisco can mirror selected bits of your LAN traffic. Being that most of the internet's traffic flows over Cisco products...

Some history:
In 1928 an American inventor (Henry P. Acket) was working on a method to send extremely low voltage electrical impulses over wires as a covert means of communications. He succeeded in that he was able to use the telephone companies' wires to speak to friends without paying a telephone tax. Early on, his friend Charles Isco was able to put a backdoor in the vacuum tubes with nothing more than a few drops of solder, some tin and flux. Charles showed Acket this and provided some wax cylinders of Acket's supposedly private conversation.

The FBI heard of this and took all their patent-pending information. Acket and Isco were paid the then huge sums of $1M and $500K respectively to shut up.

Fast forward to the 60's.
Early in 1963, J. Edgar Hoover was perusing the FBI archives when he spotted these plans from 35 years prior. He didn't believe it but one of his technical people played Hoover a tape recording made with a successor of the equipment. The tape was of Hoover making dinner reservations at Le Grande Fiste, a homosexual dinner club. Hoover went through the roof. He destroyed all the paperwork and equipment. After months of extreme drug therapy which rendered the technician nearly incoherent, Hoover had him framed for a crime we are all familiar with. The technician's name? Lee Harvey Oswald.

Ahh.. the technology survived
In the 1980s some people from Stanford University were going through recordings of Oswalds. Playing them backwards they could hear the terms "Black Helicopters", "Area 51" and "Backdoor Device". The truly learned already know about black helicopters and Area 51.. but what was this "Backdoor Device" Oswalds was rambling about? Those investigators, Len Bosack and Sandy Lerner, went on to form Cisco.

If you look inside any Cisco product you'll find a small vacuum tube with hacked in piece of tin, some solder and flux.

I present this information at grave risk to myself.

Re:Cisco's Life Lesson - Maybe not.

[akintayo]

I have a problem with that scenario on two levels; important data should be properly backed up and two customers should be told about this 'feature'. I think some owners of critical data would have some reservations about allowing Cisco unfettered access to their data.

Re:Cisco's Life Lesson - Maybe not.

[Allen Zadr]

That's the point. If you have a disgruntled employee about to release said exploit, etc. Fire him, change the 'hardcode' password, put out an unappologetic advisory. Have people install the new firmware (with the new password).

Nobody but a few key developers have a clue that the fix is not actually a fix.

It's just a theory, and if you look at my post, I fully admit - it's paranoid.

Re:Cisco's Life Lesson - Maybe not.

[grub]

I had lost the enable password for a Cisco 1601 (olde ISDN) many years ago. Cisco faxed me some info on how to bypass it on startup. Just needed an RS-232 connected at boot up and their directions.

Re:Cisco's Life Lesson - Maybe not.

[Cipster]

I agree but you must make the backdoor/override acessible only if you have physical acess to it.
This way it's much more likely that you client will recop their data rather then have it stolen through the network.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

Agreed with the statement " releasing this information because an employee either threatened to leak this information, or was mis-using this information to his/her own gain..." and what's sad is most people will still say something like, "Cisco would never do something like that." It could have been something forgotten that seeped into the production line although I doubt it. On a side note though, most of the times it'd be an admin's fault for allowing something/someone to access their routers, it's what access lists are for, and one can easily block anyone from accessing a router unless it's from a specific location, so while I find it amusing, I don't find it "threatening" to the extreme.

Besides, with SCADA, CALEA, and all others kinds of junk, I'm more worried about someone posting worse news than just "Cisco has a default ***" messages. I'd be more concerned if Mae-East and Mae-West or some other backbone was accessed and THEN Cisco said something.

segment @ politrix

Re:Cisco's Life Lesson - Maybe not.

[Zathrus]

I see a great many people buying hardware from Cisco's competitors in the near-future.

What makes you think that they don't have a backdoor username/pw as well? It may not be hard coded (they could both be strings that are determined by a hash function, based on the date/time or some other changing value), but I'd bet you they're there, at least on any high end equipment. Why? So that the damn thing is supportable remotely... even after some idiot admin screws up everything else. And, no, resetting the firmware on these things to restore the default admin password isn't acceptable -- simply because in doing so you'd lose all the other settings (bad for two reasons -- 1) they usually take hours or days to setup correctly, 2) if you're accessing the box for support, you probably want to see what the hell happened in case it was a bug).

Re:Cisco's Life Lesson - Maybe not.

[DJStealth]

If it is necessary to have a backdoor, it should only be enabled temporarily via a switch/hardware button (in the case that the admin password was forgotten).

I.e. in order to get in through the backdoor, you need to hold down a button for 10 seconds, and the login will be enabled for the next 2 minutes (which should be enough time to change the admin pw if it is forgotten). This would require that the site be physically secure; however would prevent those from remotely accessing the backdoor (unless someone is actually there to hit this 'switch).

Re:Cisco's Life Lesson - Maybe not.

[Allen Zadr]

Yeah, but their official advisory (pretty easy to get if you are a registered customer), says to install a firmware fix. That fix, be-it an actual removal of the userid/password, or a paranoid password change, is just as installable, either way.

And a post on /. isn't exactly what would qualify as a secret now, is it?

Re:Cisco's Life Lesson - Maybe not.

[i_am_pi]

Well, resetting the firmware on Cisco's devices does NOT reset the rest of the settings.

The process goes like this:
Boot device with console cable
Hit ctrl-c during boot
use the proper command to change the configuration register to 0x2142, which means "Start up using OS from flash, but IGNORE configuration in NVRAM".
Use the proper command to boot the device.

You'll then be staring at "Password: " where it will accept an empty string. The configuration is still there (type show startup-config and you'll see the whole thing), but ignored.

Enable yourself. copy start run (bring everything back up).
config t (begin configuration)
username blah password blabla priv 15 (if you have multiple usernames + priv levels)
enable secret blabla (big-daddy enable password)
line vty 0 4 (telnet access)
login
password bla
exit
config-reg 0x2102 (stop ignoring the configuration)
exit
copy run start (save that daddy)

Re:Cisco's Life Lesson - Maybe not.

[hawkbug]

while that sounds good, there are ISPs out there that lease routers to customers... on site. So, the customer would have physical access to the router even though they don't own it. Without padlocking the router shut, this would be very insecure. I'm taking the stance that there shouldn't be a back door at all.... Sure, maybe a way to reset the admin password, along with the entire flash rom, from the physical box... but backdoor? No way.

Re:Cisco's Life Lesson - Maybe not.

[fozzmeister]

I totally disagree, If the company who purchases the product doesn't take sufficient action to see that thier data isn't lost it is thier fault. After all they could put a common user/pass on all thier systems themselves (self back door).

I'm very sorry, but if I found out that someone had backdoor'd one of my systems I;d like to know why, and "I thought you were too stupid to ensure your own data" is not an excuse I'd be willing take!

Re:Cisco's Life Lesson - Maybe not.

[Da_Weasel]

They are called "Aluminum Foil Deflector Beanie" and its not called pananoia when the man is really watching your every move!!

On a serious note...I won't be buying any cisco equipment any more. I'll just use an old box and Linux for all my needs.

Re:Cisco's Life Lesson - Maybe not.

[strictnein]

Holy f@ck I'm an idiot.

I got to this point:

The technician's name? Lee Harvey Oswald.

Before realizing something was wrong with this post.

Re:Cisco's Life Lesson - Maybe not.

[Fez]

Efficient routers have a similar feature. They have a button on the bottom that when pressed for 5 seconds, it will take the last few digits of the serial number as a console-only password. No settings are lost, but you can get in to change the password. At least this is protected by limiting a person to having physical access.

Also of note on Efficient SDSL routers (and likely others) the decimal equivalent of the last octets of the MAC address is the serial number. Useful if you don't have physical access to the router.

Re:Cisco's Life Lesson - Maybe not.

[On Lawn]

That fix, be-it an actual removal of the userid/password, or a paranoid password change, is just as installable, either way.

Upgrading firmware or substantive software is always a process of weighing costs v benefits. The costant cost of upgrade is that something breaks and renders years of investment at risk. Bodies in motion tend to stay in motion is almost as true for computers as physical bodies with mass.

So while "just as installable" may be an accurate way of saying a password change is just as installable as a username/password removale, what you are not addressing is the alert that is often needed to light the fire of sysadmins to apply that fix. In this case, anything less than disclosure would have been seen as disengenious as many would not have been given accurate enough information to perform the cost benefit analysis of upgrading.

And a post on /. isn't exactly what would qualify as a secret now, is it?

I'm not seeing where you are comeing from or where you are going with this. But it seems important, you may wish to elucidate.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

I highly doubt that they will be embarassed enough to have learned a powerful life-lesson.

Cisco doesn't make mistakes, they define new industry de-facto standards. Expect Juniper to issue a press-release shortly about some of their products having a backdoor as well. They're always followers.

Re:Cisco's Life Lesson - Maybe not.

[El_Ge_Ex]

If I were your boos I were fire you for using up so much creativity (let alone time!) on this post when you could have been doing WORK!

but what am I saying? you're probably just soem 12 yr old kid that got distracted while writing the next Win/macro virus, in which I say: "kudos".

-B

Re:Cisco's Life Lesson - Maybe not.

[Total_Wimp]

...there are ISPs out there that lease routers to customers... on site. So, the customer would have physical access to the router even though they don't own it.

Although I understand your criticism of the idea, I have to point out that physical security is the first step, and arguably the most important step, in logical security. In other words, if it's not physically secure, you should never consider it logically secure.

These ISPs should change their practice if they claim to be offering a secure product

TW

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

12 yr old kid

*3 ) + 2

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

...but there must be also a second level software backdoor if the switch/button is broken or stolen by a klepto-butto-maniac...

Re:Cisco's Life Lesson - Maybe not.

[Didion Sprague]

Fuck!

Is that you Thomas Pynchon?

Damn.

Re:Cisco's Life Lesson - Maybe not.

[IO ERROR]

Come on, everybody's been doing this, for decades, even. I'm sure a few people around here remember VMS's "FIELD" login with password "SERVICE" which nobody ever bothered to change because, theoretically, nobody knew about it. As it turned out, it was common knowledge among crackers...

Re:Cisco's Life Lesson - Maybe not.

[kalidasa]

OK, if any joke post deserved to be marked "insightful," this is the one. Of course, it doesn't matter, because it's an AC.

Re:Cisco's Life Lesson - Maybe not.

[nate1138]

First off, these devices can be reset in several different ways without losing the configuration.

Second, once you have the device configured properly, you should back up your configuration with TFTP or over the console to make recovery easy. This way, even if the device itself is fried, you can just dump your config onto a replacement unit and get on with your day.

Re:Cisco's Life Lesson - Maybe not.

[txviking]

That fix, be-it an actual removal of the userid/password, or a paranoid password change, is just as installable, either way.

no. it just changes the user/password pair to another one, only know to Cisco until somebody hacks it.... ;-)

Re:Cisco's Life Lesson - Maybe not.

[Allen Zadr]

My comment, "post on slashdot isn't exactly what would qualify as a secret", was really in direct reply to On Lawn's post

Basically I was clarifying both that a 'backdoor password change' and a removal of the backdoor would itself would both require the same firmware be changed by the end user in the same way. This isn't a case of changing an NVRAM* set password, as the backdoor was hard-coded into the firmware.

Of course, it's also interesting that the required code changes to modify a hardcoded password would be far less intrusive (thus my theory in the first post) than completely removing the back-door functionality.

*NVRAM - My familiarity with Cisco products is from a WAN Router IOS software point of view. Userid/Password sets are set in and area of NonVolitile RAM that is not modified when the firmware is updated.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

If it is necessary to have a backdoor, it should only be enabled temporarily via a switch/hardware button (in the case that the admin password was forgotten).

You don't need a switch for this, it's already there in the firmware. If you have physical access to a Cisco router, you can reset the admin password by rebooting the router, issuing a break command, and then changing the password. It's a bit more involved than that, but the function is there just in case.

Re:Cisco's Life Lesson - Maybe not.

[arivanov]

I see a great many people buying hardware from Cisco's competitors in the near-future. Like right now.

I do not.

IMO, you definitely do not understand how Cisco marketing functions. It took me 5+ years of dealing with it to start understanding it. Basically, every single IOS release they shipped is bug ridden beyond any reasonable limits. Any other company shipping such crap would have failed long ago. They did not. The reason is that they have created cottage industries of "certified specialists" all over the world which will make sure that their customers and employers will never buy anything but Cisco and never hire an unfettered one. Just have a look how many banks run "Cisco Only Networks". The reason for this is simple. They are employed because there is always something wrong and there is always something to fix. Cisco knows this and it will never ever kill what makes 90% of its enterprise sales.

This is also the reason why even Cisco supplied GUI or centralised management solutions never manage some features. This is also the reason why there is no way in hell for you to get anywhere trying to manage Cisco gear using industry standard protocols. Ever tried to do some alteration of IP parameteres on Cisco via SNMP? I am not even talking about rocket science like the diff-serv MIB or the BGP MIB. Ever tried to hook it a proper element manager without few Ms of glue code that does direct CLI? Dream on...

Re:Cisco's Life Lesson - Maybe not.

[gl4ss]

yeah who exactly is watching that the customers don't just switch a differently configured router to the same lines(if they were really offering a device for clients on lease the clients weren't supposed to be able to configure).

as to the need to have a backdoor, WHAT THE FUCK? isn't there serial lines on their better stuff for the actual configuration of that kind, what do you need a backdoor for, for 'easy problem solving'? it's just so stupid and boneheaded for them to actually have such a thing in them when they're so big a corporation they really can't trust everyone to keep their mouths shut about something so irresponsibly stupid.

Re:Cisco's Life Lesson - Maybe not.

[btwIANAL]

I believe the reason this does not have a dip switch is that it is a wireless solution, and is usually accessable to the public. And any Jow Schmo could walk up to the device and give himself access using the physical method of resetting the password. They are also used in inaccessable places (ie telephone poles, roofs, anyother place you can think of that will give the highest yeild of accessable air volume for connectivity).

Re:Cisco's Life Lesson - Maybe not.

[rob_kg]

I wouldn't call this paranoia.. this is obviously a deliberate backdoor so it's too serious.. i hope for them that this is their ownly product that has such a backdoor as in no doubt the underground will be looking everywhere in cisco products for more of these.. And who controls somuch routers on the internet has immense power.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

**brings back flashes of cisco training in Highschool**

CCNA training was so useless to my everyday life..

But man, if anyone has a cisco router who doesnt remember their password.. well they should be fired. But I can fix it!

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

How about this for a headfuck...

Maybe there is no backdoor... until you install the patch?

Re:Cisco's Life Lesson - Maybe not.

[scubacuda]

He was just on the Simpsons, you know...

Re:Cisco's Life Lesson - Maybe not.

[Just Some Guy]

Second, once you have the device configured properly, you should back up your configuration with TFTP or over the console to make recovery easy. This way, even if the device itself is fried, you can just dump your config onto a replacement unit and get on with your day.

Exactly. I'd tried "we don't have a backup of the router config" pretty much the same as "we don't have a backup of the webserver" when deciding how badly I'd have to lart the respective administrator. Even little home routers often have the ability to transfer their configs, even if just via their web interface.

Re:Cisco's Life Lesson - Maybe not.

[scubacuda]

Funny, I was thinking the same thing.

Too much Art Bell, I guess....

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

Best Troll Ever! This, kids, is 'leet speak; and the anon submission defying all karma whoring really places this jewel in the shrine of all /. posts... I'm bookmarking it for future reference...

Re:Cisco's Life Lesson - Maybe not.

[Intocabile]

They did this, unfortunately the robotic arm that comes standards with ever Cisco product (Why Cisco? WHY???) is easily hacked.

Re:Cisco's Life Lesson - Maybe not.

[cpthowdy]

It doesn't matter a whole lot... if an intruder has physical access to your gear, you're fux0red either way. And it's not like someone with physical access couldn't connect to the management console port with their laptop, cycle the power, and do the ol' password recovery hack that Cisco gear has built into it. See here for more info: Cisco Password Recovery Procedures

Re:Cisco's Life Lesson - Maybe not.

[Pfhreakaz0id]

sounds a lot like oracle.. sell extremely expensive, exremely powerful products which are poorly documented and often littered with bugs. Then sell support and consulting, not to mention spawn an industry of full time DBA's to understand the intracies.

Re:Cisco's Life Lesson - Maybe not.

[Feanturi]

Yeah, but their official advisory (pretty easy to get if you are a registered customer), says to install a firmware fix. That fix, be-it an actual removal of the userid/password, or a paranoid password change, is just as installable, either way.

And that advisory will probably be read and followed by as many people as the ones that pro-actively protected their systems against the Code Red worm. Code Red flourished for months, it was bloody ridiculous.

Re:Cisco's Life Lesson - Maybe not.

[mcowger]

Wow...You missed Henry P. Acket??? Henry Packet.....

Re:Cisco's Life Lesson - Maybe not.

[BuckaBooBob]

I am sure moments after the person who decided to make the username static if finished being flogged and sacked there will be a firmware update.. The only problem is Its likely they a vast majority of these devices will not get the firmware update. But to good to see Cisco get some bad press from time to time.. need to keep competition fired up :)

Re:Cisco's Life Lesson - Maybe not.

[TekPolitik]

All the more reason not to use Cisco.

Seriously, Cisco equipment is at least 3 to 8 times as expensive as the alternatives, and IOS is basically a proprietary operating system.

Give me a rack mounted Linux server with one PCI LAN card and an ethernet interface any day. A hundred times the flexibility, no vendor lock-in, a fraction of the price. More memory, more power.

There's really no excuse for using Cisco anymore.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

The truth hurts?

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

Don't blame cisco. Big Brother made them do it

Re:Cisco's Life Lesson - Maybe not.

[drinkypoo]

The right way to do it is the way password recovery is implemented on normal modular cisco hardware. Something has to be done on the serial console. You can hook them up to terminal servers (which can be built fairly reasonably from PCs with multiport serial cards, rather than giving Cisco over a thousand bucks for what is basically a very low end computer with a bunch of serial ports and an ethernet device with an excessively limited operating system on it) and then you can control access to their back door at the terminal server (which optionally could be disconnected from all networks but one specifically for management, which is never connected to the internet.)

Re:Cisco's Life Lesson - Maybe not.

[drinkypoo]

Wally: You are the wind beneath my wings.
Dilbert: Next week I'll tell him the packet must be lost in the "ether" net.

A.C., I could fly higher than an eagle...

Re:Cisco's Life Lesson - Maybe not.

[afidel]

It's not usually a matter of not remembering, at least not on a personal level. It's usually a matter of their not being any institutional memory. That is the person who configured that router is now gone/fired/dead/unknown and there is no documentation because that wasn't important at 3am, getting the damn thing working was.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

I see a great many people buying hardware from Cisco's competitors in the near-future. Like right now.

Yeah! This is good news for Linksys. Wait a minute...

Re:Cisco's Life Lesson - Maybe not.

[afidel]

Unless you actually need it, in which case you need it and not many alternatives will do. Sure you can replace a 1700 series, or maybe even a 3500 series router with a PC and PCI card but try replacing a 7500 or 12000 series with a PC and you will be laughed at, not to mention the Cat 6500 series switches. Also you are sadly mistaken if you think a general purpose OS and generic CPU have more routing or switching power then the ASICs in just about any specialized router.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

Even open source projects (not that this example is open source, but it still applies) can have backdoors. Early Bell Labs UNIX releases had a backdoor that wasn't in the source code of either the c compiler or UNIX kernel. What happened was the c compiler was designed that when it was compiling either another version of itself or the UNIX kernel to add certain lines of source code so that future versions of the compiler were able to update the kernel source when compiling to create a backdoor. I think Ken Thompson discussed this at a conference in 1981 or so.

Re:Cisco's Life Lesson - Maybe not.

[elecbrick]

It must be a bad day. I got to

If you look inside any Cisco product you'll find a small vacuum tube

before cluing in that I have not see a vacuum tube in years.

Re:Cisco's Life Lesson - Maybe not.

[g-san]

Sweet info.

and with the specs for the console cable no one has an excuse not to play with one or three.

In Soviet Russia, the console specs post you!

Re:Cisco's Life Lesson - Maybe not.

[gandy909]

Not too familiar with Cisco gear, but if you can upgrade the firmware via software to 'fix' the problem, could you not later simply downgrade the firmware back to what it was before to recreate the problem?

Re:Cisco's Life Lesson - Maybe not.

[Allen Zadr]

I would point out here that UNIX was not Open Source, the BSD branch of UNIX became open source, and Linux was an OpenSource implimentation of several UNIX kernel features. But System V based UNIX (HP/UX, AIX, Solaris, SCO, etc.) are still 100% closed source systems.

Re:Cisco's Life Lesson - Maybe not.

[Anonymous Coward]

-----
it should only be enabled temporarily via a switch/hardware button
-----
I think the argument against this is in a large environment.

"Where's router 192.168.156.1?"
"I dunno, over in building 25C somewhere."
"Shouldn't it be on floor 3 room 44 according to this map?"
"Sure, but last time I checked, that was the janitor's broom closet in the bathroom."
"Why would they put a router in there?"
"They didn't."
"So where is it?"
"I dunno."

Where's that hardware switch?

+++ATHZ

Re:Cisco's Life Lesson - Maybe not.

[TekPolitik]

Unless you actually need it, in which case you need it and not many alternatives will do.

However most Ciscos are installed at site gateway (at the edges of the network, not hubs), because that's what the NSP said to use (or sold as a result of an agreement that's probably in breach of competition laws).

Also you are sadly mistaken if you think a general purpose OS and generic CPU have more routing or switching power then the ASICs in just about any specialized router.

Dollar for dollar, you're going to be getting better hardware performance from systems based on the generic stuff when you have the premium pricing that Cisco charges. As for operating system performance - that can be fixed.

I...

[Seoulstriker]

I simply can not believe this has happened. This is more boneheaded than what Microsoft has done for the past few years.

Re:I...

[rgmoore]

What makes you think that this was a Cisco policy? It's far more likely that this is the work of some rogue coder within Cisco who added it without anyone else's knowledge. It's not as though adding a backdoor password is very tough for somebody who has access to the relevant code. If there aren't detailed code reviews, a backdoor could hide out for a very, very long time.

Re:I...

[Anonymous Coward]

Its far more likely that they did this on purpose for the sake of law enforcment

Re:I...

[Anonymous Coward]

"Yeah, but Jim, you're giving away all our best tricks! That girl's standing over there, and you're talking about back doors."

Re:I...

[YrWrstNtmr]

If there aren't detailed code reviews...

Like the parent said...boneheaded.

Re:I...

[Mikkeles]

'If there aren't detailed code reviews, ...'

Given the business Cisco is in, it is moronic not to have code reviews and a locked down CMS. Heck, that is a major part of the reason that these people are paid big bucks.

Re:I...

[grub]

Rogue coder within Cisco

Perhaps. Although you have to remember that Cisco has grown so large and with such a massive product line because of aquisitions. If this wasn't a Cisco home-brewed product then there's a good chance this backdoor was in there from the previous company.

Re:I...

[dtfinch]

The idea of a master password is nothing new. A lot of pc bioses were like that. It allowed their tech support to easily "recover" a system where the malicious user (like ex-admin or ex-girlfriend) set a random bios password, at the cost of giving a false, but often effective sense of security.

Re:I...

[Strider-BG]

True. But the Key factor is that this u:p is accessible from a remote connection. Backdoors are common and necessary for reasons like the above. However, care must be taken such that these backdoors are only accessible from some sort of physical/console connection. *NO* system is safe if a person has physical access.

Refund?

[valjean78]

So what are they going to do for the people that purchased these?

Re:Refund?

[Anonymous Coward]

hahahahaha...

oh wait, you're serious....

hahahahahahahaha

Re:Refund?

[MarkGriz]

Why would they need to do anything beyond posting a patch (which they already did)

proof of concept

[Anonymous Coward]

Proof of Concept

And the username/password pair is...

[momerath2003]

admin/password.

Re:And the username/password pair is...

[orrigami]

That is my root password.

Re:And the username/password pair is...

[ShallowThroat]

no, you idiot, the password is clearly SEX. that, or GOD. have you even seen HACKERS?

Re:And the username/password pair is...

[mitchell_pgh]

Sorry, the real password is...

1... 2... 3... 4... 5... 6...

Re:And the username/password pair is...

[Eu4ria]

no its probably 31337/h4x0r

Re:And the username/password pair is...

[Anonymous Coward]

Actually it is user/password

Re:And the username/password pair is...

[segfault7375]

Really? What's your IP? :)

Re:And the username/password pair is...

[agentZ]

That's the combination on my luggage!

Re:And the username/password pair is...

[Anonymous Coward]

Amazing! That's the same combination as I have on my luggage!

Re:And the username/password pair is...

[PornMaster]

Nah... n0r73l5ux :)

Re:And the username/password pair is...

[orrigami]

127.0.0.1

Re:And the username/password pair is...

[MacOS_Rules]

I found it! The little bugger is at 127.0.0.1, and confirmed, the l/p work! OMG, tons of pr0n! ;)

Re:And the username/password pair is...

[stevey]

The IP is 127.0.0.2

Re:And the username/password pair is...

[colonwq]

Ack. That is the same code that I sue on my luggage! I have to change yet another password to change.

:wq

Re:And the username/password pair is...

[Anonymous Coward]

192.168.0.1

Re:And the username/password pair is...

[okvol]

My favorite password is ******

Re:And the username/password pair is...

[swordboy]

That's the same login that I use on my luggage!

Re:And the username/password pair is...

[Anonymous Coward]

Hey, he likes the same porn I do. He can't be all bad!

Re:And the username/password pair is...

[Minwee]

Wow, that's the same combination I have on my luggage.

Re:And the username/password pair is...

[nharmon]

Space Balls rules! :)

Re:And the username/password pair is...

[orthogonal]

My favorite password is ******

I quote from bash.org:

#244321 +(2664)- [X]

<Cthon98> hey, if you type in your pw, it will show as stars
<Cthon98> ********* see!
<AzureDiamond> hunter2
<AzureDiamond> doesnt look like stars to me
<Cthon98> <AzureDiamond> *******
<Cthon98> thats what I see
<AzureDiamond> oh, really?
<Cthon98> Absolutely
<AzureDiamond> you can go hunter2 my hunter2-ing hunter2
<AzureDiamond> haha, does that look funny to you?
<Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as *******
<AzureDiamond> thats neat, I didnt know IRC did that
<Cthon98> yep, no matter how many times you type hunter2, it will show to us as *******
<AzureDiamond> awesome!
<AzureDiamond> wait, how do you know my pw?
<Cthon98> er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
<AzureDiamond> oh, ok.

Re:And the username/password pair is...

[Devil's BSD]

Really? My root password is 1-2-3-4-5.

Re:And the username/password pair is...

[Anonymous Coward]

>I found it! The little bugger is at 127.0.0.1, and confirmed, the l/p work! OMG, tons of pr0n! ;)

No pr0n when I connect there, but I'll be damned, THAT BUGGER HAS A COPY OF ALL MY FILES!

Re:And the username/password pair is...

[EqualSlash]

May be this extensive list should help ..

Re:And the username/password pair is...

[ichimunki]

That is the single funniest thing I've seen today. Much better than all these references to SpaceBalls, War Games, and other not-so-worthwhile movies.

Re:And the username/password pair is...

[Herkum01]

Evidently they hacked your computer and copied all of your stuff too. Probalbly someone in your house, you can tell because it takes no time to copy anything...

Re:And the username/password pair is...

[RussDavisDotCom]

Correction: That WAS your root password.

Re:And the username/password pair is...

[SphynxSR]

should be mod'up but I got it.

Re:And the username/password pair is...

[beerits]

Stay away from my luggage!

Re:And the username/password pair is...

[Anonymous Coward]

I tried that too, but all of the porn I saw, I have seen already...

Re:And the username/password pair is...

[dtfinch]

Remove the dashes and you have one of my online passwords. I won't say what it goes to.

Re:And the username/password pair is...

[Anonymous Coward]

You have a root password?

Re:And the username/password pair is...

[Anonymous Coward]

What a great way to get a quote onto the top 100 page. I'll have to try that sometime.

Re:And the username/password pair is...

[Alsee]

Holy shit! It's all kiddy pr0n!

-

Re:And the username/password pair is...

[Anonymous Coward]

Delete them all from his drive! Quick!

Re:And the username/password pair is...

[Ironsides]

Top Gueses for User/Pass
The user/pass is:
Spook/Subpena
FBI/Agent
CIA/NSA
FBI/Snoop
Bill/Gates
(God or Sex or Love)/(God or Sex or Love)
Cisco/ocsiC

Anyone know what it is for sure? and why they put it in there?

Re:And the username/password pair is...

[platipusrc]

er...might want to watch out for that...Ashcroft's lackey Lam Nguyen will find it, look through all of your stuff, categorize and save it to disk, then tell on you!!

Re:And the username/password pair is...

[rhuntley12]

Yeah, what's with all that guys goat porn too? What a sick bastard.

Trust No One

[aaron240]

Anything that can be exploited will be exploited. The key is to take every precaution possible--that's not possible when only a select few can see the code.

Radio cards?

[Kethinov]

I wonder of these insecurities are in my Cisco 350 series aironet radio card? My ISP should be informed of this if they are there.

Re:Radio cards?

[Anonymous Coward]

The default password is "Cisco" but you can change that.

Re:Radio cards?

[Anonymous Coward]

its your get out of jail free card...i would keep that under your hat incase you're ever busted for porn/terrorism

Well, that depends.

[AltGrendel]

Cisco actually has a better track record than some other closed source vendors I could mention.

Re:Well, that depends.

[Knight Thrasher]

Great. So... that makes it Ok then?

Re:Well, that depends.

[irokitt]

Indeed, until now I haven't had any reason to dislike Cisco(although their equipment is expen$ive). Companies like Symantec and Roxio have always been higher on the list of people who will be the first against the wall when the revolution comes. But guess I'll be looking at Cisco more closely.

On another note, I guess the guys at the school lab need to hear this one.

Re:Well, that depends.

[InadequateCamel]

Cisco actually has a better track record than some other closed source vendors I could mention.


That's a silly comment. Up until a few hours ago you would have thought Cisco was pretty good. Now they have done a really stupid thing and have been caught red-handed.

The question we should be asking is what else have they done that their customers would object to if they knew about it?

Call me paranoid, but this is exactly the sort of behaviour that I expect from software/hardware manufacturers. Cisco just happened to get caught doing it.

Re:Well, that depends.

[orthogonal]

Cisco actually has a better track record than some other closed source vendors I could mention.

I don't mean to be a grammar troll, but clearly you used the wrong tense:

"Cisco actually had a better track record...."

Re:Well, that depends.

[Mysticalfruit]

Well that and their use of "Cisco" math when it comes to what their switches will push for throughput.

For the same money you'd spend on a Cisco switch you can probably buy a Nortel that'll run circles around the Cisco.

Or, if your tripping over the bags of cash or their just blocking the door, you could spring for a Juniper...

Don't get me wrong, Cisco stuff works, it's just really expensive and their are cheaper more capable equipment on the market...

Re:Well, that depends.

[rttichnor]

Mod parent -2 (Grammar Troll)

Track records are constantly evolving. I beleive 'has' was appropriate.

Re:Well, that depends.

[arivanov]

Really?

They continuously use codebase from the opensource parts of the software world and lie about it. The only OSS component they currently admit to is the regexp library. In fact they have used code from xntpd (and were bug for bug vulnerable to NTP exploits), OpenSSL, OpenSSH, so on so forth, ad naseum. When a vulnerability in any of these comes around they never admit it because the IOS sacred cow is supposedly pure and not infected by any opensource (besides regexp). This continues until someone starts running the exploits versus their gear. And after that ... BANG... Check BUGTRAQ for the SSH and NTP exploits as a fine example. I bet there are others as well.

They constantly have idiotic ideas like CDP which are insecure by design and turned on by default.

They have promoted a very long list of outright lies including security ones in the exam preparation materials and exam question. That is also besides the fact that Cisco does not consider the analysis for correctness and sane security practice of these materials to be fair use and disallows quoting them. Here is one that has managed to get through:
http://lists.netsys.com/pipermail/full-d isclosure/ 2003-October/012809.html

There are many others.

So on so forth. Ad naseum. If you think that Microsoft is vile you definitely have not had to do a lot of network engineering especially with Cisco kit...

Re:Well, that depends.

[JPriest]

Well, yeah. Considering Cisco's market penetration and popularity it is amazing they have had so few security problems. They have a track record that even Apache should envy. One mistake and some of that slashdot mind-droids are spouting "well, that is because they are not open source".

Re:Well, that depends.

[asmussen]

Sure, but I think that his point wasn't to correct grammar, but rather to point out that as of this incident, Cisco's track record isn't as great as it used to be.

Re:Well, that depends.

[txviking]

I think the point is:

In an age of acces through networks, is it possible to trust any private organization enough to not oversee them with what they are doing ?

Or is it almost obligatory to know exactly what a particular device/computer etc. does, or at least have the possibility of own, or third party assessment.

Re:Well, that depends.

[ron_ivi]

Parent wrote: "The only OSS component they [Cisco] currently admit to is the regexp library. "

Not true. From Cisco's web sites we read:

"
The three major components of CSR are as follows.

* postgreSQL Database
"

I, for one, wish they used more OSS components, since at least these parts have been peer-reviewed to not have trojans or backdoors as mentioned in the article.

Re:Well, that depends.

[re-Verse]

Whoever modded this offtopic has the sense of humour of a brick.

See, what he is explaining is that due to Ciscos inherent stupidity at adding an override all password, their track record, that was once the shit, is now just shit. Get it???

Re:Well, that depends.

[arivanov]

That is CSR, not IOS. The only OSS component they confess to in IOS is regexp. I have not had access to IOS code, but how to say it... I find the similarity of strings and bug for bug compatibility in IOS and some OSS products to be more then highly amusing...

Re:Well, that depends.

[Cramer]

Unless you downloaded and compiled the binaries from the postgresql.org server(s), then you cannot say, for sure, Cisco has not added backdoors to the code.

Re:Well, that depends.

[Mateito]

> Don't get me wrong, Cisco stuff works, it's just
> really expensive and their are cheaper more
> capable equipment on the market...

True.

Just remember that none of the "more capable" equipment is made by 3com.

Re:Well, that depends.

[Cramer]

... oh, like the OpenSSL ident strings. 12.0 used OpenSSH, but they have since stopped using OpenSSH code in IOS -- they either rolled their own or snarfed someone else's. They've removed almost all of the ident strings except for those put there by the compiler: GCC: (GNU) 2.95.3 20010315 (cisco p10 release), etc.

Re:Well, that depends.

[WhiteDragon]

For the same money you'd spend on a Cisco switch you can probably buy a Nortel that'll run circles around the Cisco.

Or, if your tripping over the bags of cash or their just blocking the door, you could spring for a Juniper...

Or, you could buy a Big Iron switch from Foundry that will blow away most of the offerings from Cisco.

Re:Well, that depends.

[pyite]

The thing I love about Cisco is you can do Carrier Class Core, Distribution, and Access all with one company. That's hard to match from a configuration/ubiquity standpoint.

Re:Well, that depends.

[rsidd]

Still no cigar. It should read, "We actually thought Cisco had a better track record..."

Re:Well, that depends.

[Anonymous Coward]

>> like Symantec and Roxio have always been higher on the list

Uhm........ can you please warn us first?

-Roxio Support Employee

Re:Well, that depends.

[Anonymous Coward]

SCORE: 1 for the "slashdot mind-droids", 0 for Cisco!!!

Really it isn't a mistake to consciously create a backdoor is it

Re:Well, that depends.

[sirsnork]

Actually the question we should be asking is where the HELL is the firmware update to remove this "feature".

I can't understand anyone releasing an advisory that says "Yeah we screwed up and got caught, but we're not even going to try and fix it so there"

Re:Well, that depends.

[GarryOwen]

What you pay for with Cisco is support. In my experience when you have a 4-hr contract with Cisco you will get your part in 4 hours. That can't be said with Nortel. I once had a next day contract with them and it took them till the next monday(it was tuesday) before I recieved the part. I had several other experiences similar to that later.

Re:Well, that depends.

[Sivar]

I beleive 'has' was appropriate.

You misspelled "believe" ;)

Re:Well, that depends.

[freebase]

The patch is already available to registered CCO users.

If you read the notification on CCO, you'd know that.

Re:Well, that depends.

[freebase]

Can anyone know enough about everything to have the ability to make an assessment on their own? I think not.

If you rely on a third party assessment, you're still trusting someone else's claim to knowledge and integrity. Either way, you either trust your vendors or you don't.

This is not the first backdoor in network gear. In fact, this isn't, from a risk perspective, that massive an issue in a well designed network.

The backdoor allows access to the WLSE or HSE itself, not nec. to the devices it manages. Proper security (ACLs - why would you allow anyone coming in wirelessly to connect to your wireless management device?- etc) limits this risk significantly.

I'm really tired of people getting part of the story, or not thinking things through before they go off the deep end.

Re:Well, that depends.

[platipusrc]

I don't really know very much about Cisco stuff or their policies, but I do know that neither OpenSSH, OpenSSL, nor xntp can infect a product because they're all under some sort of permissive license (BSD-like). So really they don't have to own up to using those software products if they don't want to.

Re:Well, that depends.

[PurpleFloyd]

While Cisco does have a decent security track record (exempting this colossally boneheaded manuver), your tirade against "slashdot mind-droids" is simply false. Backdoor passwords tend to be one of the most obvious things to detect, excepting serious trickery like putting the password into the compiler. Code that looks like

if (inputpasshash==storedhash)
{
return TRUE;
}
else if (inputpasshash==BACKDOOR)
{
return TRUE;
}
else
{
return FALSE;
}

tends to stand out pretty well during a code audit, and is visible even to a beginning C student. Backdoors are harder to sneak into open source software, simply because people will watch your every move and might not agree with all your changes.

Re:Well, that depends.

[m0rningstar]

I'll second the support comment. I am biased -- I work for a Cisco gold partner based in New Mexico, but you know; you can and will get support when you need it.

(Off topic, I totally believe that not all TAC's are created qual, even within Cisco -- give me Sydney any time for a problem. Many people even delay calling until then).

But Cisco is pretty good about releasing vulnerability and other statements. No-one is perfect, and some of their issues (the ex-Strataccom ATM switches with passwords you need a TAC engineer to change) suck from a security standpoint. Overall, though ... I'd rate them as good, responsive when there is an issue, and good at updating, releasing and dealing with advisories.

Re:Well, that depends.

[asdfghjklqwertyuiop]

How exactly would OpenSSH, OpenSSL and xntpd 'infect' anything anyway?

Re:Well, that depends.

[afidel]

Ummm, the very article you linked has a link to the review of the Cat-6500 which did better on the same tests.... Not only that but the numbers seem to indicate that the switching fabric of the chassis can't really handle the 40x1Gb card talking to the 4x10Gb card, whereas a 6509 can take 6 20x1Gb cards and a 4x10Gb card and switch them all at line speed and have fast failover with dual supervisor cards.

Re:Well, that depends.

[Anonymous Coward]

When I applied to become an FBI special agent, you had to have either a law, accounting, language,or computer science degree. OR you could have a CCNP or CCIE. I'll let everybody else decide why they think there is a backdoor in Cisco products, and why Cisco isn't going to fix it.

Re:Well, that depends.

[pantycrickets]

Not really, back in 95 or so.. ALL of their routers had this "feature."

Re:Well, that depends.

[Anonymous Coward]

RTFA. It gave instructions on how to get the patch for CCO registered and also users without any support agreements.

Re:Well, that depends.

[JPriest]

Wow, if only Cisco products were as secure as Bind, sendmail, or some of the many problematic open source ftp servers.

And PS, it is a good thing is can be spotted by a newbie C coder, because for most OSS, that is exactly who will be looking at it.

Re:Well, that depends.

[Tenorman]

Actually, I think the first poster may have been correct. A track record is a record of things that have happened in the past. So if we're talking about a list that extends from the distant past to the present, when it terminates, then I'd say the present tense is justified. If the poster meant to say that until this point the track record was better, then "had" is the right choice. But if he/she meant that even given this incident the record of Cisco is still better, and I think that's what he/she meant, then "has" is more gramatically accurate.. I can't believe discussing tenses on Slashdot..

Re:Well, that depends.

[Bob Davis, Retired]

The patch, of course, just resets the back door user / pass couplet to new, unknown values.

Re:Well, that depends.

[blogan]

I'm not sure backdoors are as blantantly obvious. What about something like this?

hash = getHash(password)

if (hash) {
return (*hash == *storedhash);
} else {
logAuthError("Hash could not be found");
return FALSE;
}

Looks correct, but if I modify getHash to return NULL when the password is a certain string, and logAuthError is actually buried in a separate header, it doesn't actually log an error, it returns TRUE.

Re:Well, that depends.

[WhiteDragon]

Yeah, I also noticed that the routing table can't hold a million entries *grin* but I was mostly just mentioning them as an alternative to Cisco.

Re:Well, that depends.

[Anonymous Coward]

Looks correct, but if I modify getHash to return NULL when the password is a certain string
You mean like

if(password == BACKDOOR)
{
return NULL;
}
else
{ ...
return &da_real_hash;
}

How is this different from grandparent?

Re:Well, that depends.

[blogan]

No, it would still not be this obvious. Once again, you could use preprocessor tricks to make it look like nothings unusual is happend (and the preprocessing would be embedded stuff, not #define start_hash if (password == BACKDOOR) return NULL, but a little more complex. Or getHash could be written in obfuscated assembly with a comment that it's needed for speed purposes. The check doesn't have to be a string compare. If you know the hash value, you could compare against the computed hash value. Or you could write a hashing algorithm that would generate a hash of 0 for your backdoor string, and then have something like

if (*hashValue) {
return hashValue;
} else { // Couldn't compute value
return NULL;
}

Or, getHash() could be part of a separate library, etc.

Re:Well, that depends.

[Allen Zadr]

Cisco Advisory on OpenSSH based IOS and other products.

I believe that this qualifies as admission of inclusion. (I found this while searching for something else, and thought it appropriate here.)

Re:Well, that depends.

[Anonymous Coward]

they tried to hack jp's, antionline during the 90's!

Open Source

[MBAFK]

Being able to read the code can stop this from happening.

Re:Open Source

[gatki]

Auditing the code only guarantees security if you trust that your compiler isn't compromised.

Auditing the compiler's code doesn't guaranteee anything either. It too had to be compiled, and the compiler's compiler may have been compromised.

Re:Open Source

[Progman3K]

>Auditing the compiler's code doesn't guaranteee anything either. It too had to be compiled, and the compiler's compiler may have been compromised.

Not if you do like me and enter the compiler's code one opcode at a time with the debug command!

Kidding aside, it should be possible to view the disk image of the compiler and verify that the generated assembly instructions in it don't contain a virus.

Re:Open Source

[DR SoB]

Wow wouldn't that be fun. So you want to be the first to try and unassemble an entire router, and go through it BYTE by BYTE, no comments (striped by compiler of course), no instructions, no write-up. Yeaa-haw! If you claim you can do this your lieing. And besides, it doesn't take much to have your program self-alter itself once it's memory resident.

Re:Open Source

[Progman3K]

I never said it would be pleasant.
You WOULD see it if there was suspicious code or data constructs that the program was using to self-alter itself.

My point is that if there is anything suspicious in there and you do an analysis like this, you could spot viruses.

Come on, a LOT of hackers load apps with copy-protection in debuggers and execute the program step-by-step until they spot the security checks and then they replace the call with a couple of NOPs.

Not only can what I'm talking about BE done, it HAS been done.

Trust me, there are a LOT of REALLY proficient programmers out there who can get along fine without source-code.

Someone will chime in here with a link to The Tale of Mel, no doubt, I'm too lazy...

Re:Open Source

[DR SoB]

It's really easy to do a dump at a certain point in a program, get the PSW and do a couple back and forth instruction lookups and figure out a small piece of the code (you know at what point in the program (game) it asks you for the password), which is why this is possible. To take an entire router program (kernal, drivers, etc.) and disassemble the ENTIRE thing is damn near impossible. I am an assembler programmer and I do have some knowledge in this. I can tell you right now, I could give the source code to excellent assembler programmers and they wouldn't be able to figure out what every single piece of the code is doing. If it were that easy don't you think someone would have reverse enginnered the Windows kernal by now?

Re:Open Source

[arivanov]

IIRC, Cisco has used GCC since 1998 or even earlier at least for some platforms. Do some strings on an uncompressed IOS copy starting from around 11.2 for MIPS based ones and 11.3 for the motorola based ones. So in fact, you can audit the compilers. Not the entire tool chain, because linker, bootstrap, etc are obviously proprietary, but compiler at least for some IOS versions I have looked at was GCC.

Re:Open Source

[Flossymike]

Well ...

What if you auditted the code for the compiler, used the compiler to compile the source code and compared md5 check sums for them?

I'll admitt it, I may be over looking something, but then again, perhaps not.

Re:Open Source

[Anonymous Coward]

don't you think someone would have reverse enginnered the Windows kernal by now?

Yes. It's called Lindows.

It's required...

[PornMaster]

All your wifi are belong to Cisco

What's the big deal?

[Anonymous Coward]

What's the big deal?

Most people don't have a password on their backdoors.

Can we really trust closed-source vendors?

[macshune]

No, obviously not when you get right down to it. Just like we can't trust closed-source e-voting software with it comes to our republic (the U.S.:), we can't trust close-source vendors whose systems power our infrastructure...that, without, the world would cease to function as it does today.

But what can anyone do? Are there any open-source makers of networking hardware?

Re:Can we really trust closed-source vendors?

[molarmass192]

That depends on how you define hardware. You can piece together some pretty powerful Linux based boxes dedicated to networking. There are also several Linux based net products advertised in Linux Magazine and Linux Journal. Also, Cisco (ahem) has the low-low-low-end WRT54G (aka Linksys) router for which you can compile and install the firmware yourself, well, minus the wireless part at least.

Re:Can we really trust closed-source vendors?

[ReallyNiceGuy]

Happy Easter! This is not a backdoor, this is an easter egg...

Re:Can we really trust closed-source vendors?

[rob_kg]

Can you trust the american elections at all?
I'm not an authority on this issue, but I believe/read that these campaigns get sponsored by rich people/businesses with best interest for themselves, the one with the most money for a campaign is most likely to win.. or should i say; the richest corporations are most likely to win.. Go figure who loses.

How Stupid.

[DAldredge]

How fucking stupid do you have to be to realize that this was a BAD THING? Damn, perhaps if Cisco stopped spending so much on stupid ads and rethought its dev process stupid shit like this would not happen.

How did anyone EVERY think this was a 'good thing'???

intentionally vague

[Anonymous Coward]

is the id/pwd pair unique to device or is it the same for all devices? i.e. is it some hash of the serial number or something?

this is the funniest hting i've read all day.

btw there exists a similar backdoor in win xp.... sorry can't say what it is. :) j/k

In Texas...

[Anonymous Coward]

I believe that this kind of backdoor abuse is still illegal, even if it is behind Closed Source.

Linksys

[ogewo]

Does anyone know if this software has been implimented in any of the Linksys products?

Re:Linksys

[fgb]

I wouldn't think they would need it. There's a tiny little recessed button on the back on my linksys unit. Hold it in for 10 seconds and presto! the unit is back to the factory configuration. Passwords and all.

No excuse for a master password. Mind you, I'm not saying there isn't one, just that there is no need for one.

Re:Linksys

[ogewo]

The reset button could compromise the unit locally, but couldn't this backdoor allow a remote compromise?

Re:Linksys

[ODD97]

I'm very curious about this as well, as I just bought a LinkSys 802.11-G Wireless Router. I don't see any answers. I'm pretty sure the reset button on the back doesn't change the coding of firmware...

Firmware?

[pholower]

Do they plan on releasing a firmware update? If so, how do we know they aren't going to put another backdoor into that and simply change the information? Is there a way they can make the firmware patch open source without giving away their other "proprietary" source?

Re:Firmware?

[Anonymous Coward]

Patch as out at the bottom of the notice.

Re:Firmware?

[spoonyfork]

Do they plan on releasing a firmware update?

RTFA.

If so, how do we know they aren't going to put another backdoor into that and simply change the information?

You don't.

Is there a way they can make the firmware patch open source without giving away their other "proprietary" source?

If you own the affected products and require open source firmware patches then you should have thought of that before you bought the product. If you require open source hardware then buy open source hardware.

Re:Firmware?

[MarkGriz]

Why the hell was this modded "Interesting". RTFA.
It's software, it's been fixed, nothing to see here. Move along.

Re:Firmware?

[bot24]

The patch will probably just change the password.

Re:Firmware?

[spoonyfork]

The patch will probably just change the password.

Hi! Reckless speculation on week-old topics is always appreciated. Here at Slashdot it is expected and encouraged. Keep up the good work, soldier!

Your giving away all our secrets!

[General Newcomb]

"Mr. Potato Head! Back doors are not secrets!"

THIS is why tech companies want to get all

[Anonymous Coward]

buddybuddy with the Dept of Homeland Security: The corps will have less liability for their stupid products, any good samaritan type will get thrown in the slammer for pointing out holes, and nobody is going to sue the US government because their company server got hax0red.

There is no workaround.

[Space cowboy]

(According to the summary). In fact you can get new firmware, and it's free for everyone so long as you go through the channels. Fair play to Cisco (or at least, well done for recognising a public-relations disaster when they see one!)

I can see why it's useful to have a master password, but really, it was bound to cause major embarassment in the end - the only way it would work is if everyone who knew it (presumably cisco employees) never ever divulged it. That's likely!

Simon

Re:There is no workaround.

[user no. 590291]

And I really believe they didn't add a new backdoor this time, but hide it better. NOT.

Re:There is no workaround.

[On Lawn]

Yeah, I remember working for a company that made network storage devices. We had to make sure that we not only didn't have a back door, but that we didn't even know the root password. Lest we be implicated in any information leaked from the company.

Yet we wanted to be able to fix a device even if they forgot their root password. What we settled for was a root password reset that was entirely visible to them at the time so if someone malicious did try to get their information they would at least know as it happened.

Re:There is no workaround.

[Anonymous Coward]

The best thing to do is to have a jumper or switch you must flip on the inside of the product to reset it. Then the casual user can't come along unless they go and unmount it from the rack and open it up.

Re:There is no workaround.

[kfg]

No, the only way it could ever work is if no Cisco employee ( and by extension exemployee ) didn't know it, and thus couldn't exploit it without divulging it. The idea that Cisco employees are somehow "safe" is absurd.

This is like saying that your vault is secure just so long as only employees of the company that made it know your combination.

Like with your car.

What, you didn't know about that?

You can have a locksmith fix that for you if you want, but then you have to trust your locksmith. You're only as secure as what you can do yourself.

The difference here though, is that the Ford employee has to make the effort to physically go to your car to use the knowledge.

A Cisco employee could crack your router while sitting at home in his underwear.

It probably isn't even clean.

KFG

Re:There is no workaround.

[ScrewMaster]

Actually, it would have made a lot more sense to embed a unique master login in each system, something algorithmically keyed to the serial number and date of manufacture perhaps. That way a legitimate user with a problem could call and request his master login without compromising anyone else.

Well, definately not buying any of those...

[BradySama]

Another example of why the benefits of open source need to be pushed up the corporate ladder... this is nuts. Almost as nasty as the things they've done for China. Thanks, Cisco. Another one bites the credibility dust.

No workarounds?

[Aardpig]

The Cisco advisory points out that there are no workarounds. This would suggest that the problem cannot be remedied.

However, the advisory also discusses how to obtain new software for their equipment. So it appears that there is a fix to the problem, via a software upgrade. In light of this, the 'no workarounds' stuff is rather misleading -- and when I first read it, it made my draw drop.

Re:No workarounds?

[dbarclay10]

However, the advisory also discusses how to obtain new software for their equipment. So it appears that there is a fix to the problem, via a software upgrade. In light of this, the 'no workarounds' stuff is rather misleading -- and when I first read it, it made my draw drop.

It's pretty much understood, at least by sysadmins if not the general public, that an issue can always be fixed by a software upgrade. Any vendor saying that an issue *really* can't be fixed, no matter what, typically means that it's a design choice and if you don't like it, switch to another vendor (*cough* Microsoft? *cough*).

Given that, when a vendor says "no workaround available," they mean that your only choice is to upgrade the software. For example, a workaround to a vulnerability in, say, Microsoft's CIFS stack would be to firewall off the ports it uses (though you need to do that on every machine, of course - otherwise it won't be effective, as we've seen so many times).

So, to sum up: workaround = quick fix via configuration or similar, and it's a given that you can fix the problem via a (typically time-consuming) software update.

Re:No workarounds?

[Anonymous Coward]

In general to Cisco an upgrade is the only long term solution but they also post workarounds for people that cant afford the downtime in a reload. This dosent have any because it would break the system to do so. A lot of the workarounds are apply this ALC on all interfaces and such, generaly things you could do to a production router without taking a downtime hit. It's fairly comon to deploy a workaround till a maitnecne window when you can apply a better tested patch.

Re:No workarounds?

[DarkProphet]

And so would it be fair to say to assume they've just changed the username / pass in the new firmware update? How do we know the backdoor has been removed without seeing the source. Hmmmm...

Re:No workarounds?

[\\]

and when I first read it, it made my draw drop.

Forget about knocking your socks off, this knocked his draws off..

Your answer

[ls-lta]

" Can we really trust closed-source venders, such as Cisco, to develop secure products that are free of backdoors?"

Yes. Lord, next you'll be asking about patents.

ummm.

[Anonymous Coward]

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

WHAT?! no public announcements? THIS IS VERY PUBLIC!

No malicious use?! Are they retarded, in about 30 seconds this user/pass combo will be on every hack site in the world... thank god I don't have cisco! This is probably killing their stock price, I'm going to go check.

No Refund - firmware fix

[Allen Zadr]

The ARTICLE that you DIDN'T read, clearly states how to get a service fix - see my first post about what I think about the completeness of said fix.

Re:No Refund - firmware fix

[thpdg]

Can't Cisco just download it to the devices themselves? They do have the password to every box, after all.

Re:No Refund - firmware fix

[Allen Zadr]

Most Cisco device updates need a local area network available with Simple FTP. SFTP is unreliable over WAN connections (especially one that's brought administratively down for a firmware update).

Of course, these are wireless routers, so the implications may be different.

Re:No Refund - firmware fix

[John Starks]

Do you mean TFTP aka trivial FTP? SFTP usually refers to the file transfer protocol over SSHv2.

But then again, I don't know much about Cisco products.

Re:No Refund - firmware fix

[thpdg]

Wait, if it's so hard to get into them, then why is the global password such an issue?

Re:No Refund - firmware fix

[frost22]

of course you refer to tftp. There is no sftp.

And, FWIW, I recently upgraded a switch remotely from 600 kilometers away over a WAN using tftp. No big deal - we do stuff like that all the time.

Oh, and of course the majority of cisco's routers and switches can upgrade their flash while in operation.

Re:No Refund - firmware fix

[Allen Zadr]

Yes, Trivial FTP. I've only ever had to do this once. Sorry

Re:No Refund - firmware fix

[Allen Zadr]

I've only ever had to do a Cisco upgrade once... Yes, it's TFTP, Sorry about that.

Very informative about the wireless firmware upload though. Is it then possible for Cisco to do this remotely through the internet as well? (can you substantiate the post I was originally trying to debunk)?

Re:No Refund - firmware fix

[ak_hepcat]

600km?

We do stuff like this all the time. Over 56k satellite circuits. Of course, we prefer to snail-mail a new flash card with the IOS, but for emergencies, tftp does work pretty well. Just slow.

Ah, Alaska. Nothing else like it.

Re:No Refund - firmware fix

[John Starks]

I was just curious. I wasn't trying to one-up you or anything.

Re:No Refund - firmware fix

[arivanov]

Seconded, Done it several thousand times over everything but carrier pigeons.

WAN, LAN, console, tftp, xmodem, over cellular - you name it.

I am not a Ciso fan (in fact I am seriously allergic to it), but I have to admit that their gear can be fixed and upgraded in almost all cases because they are one of the very few vendors which provide full upgrade/download capabilities in both their runtime and their bootstrap. So even after managing to completely bugger up a normal upgrade you still have very good chance of succeding through the loader commands.

Re:No Refund - firmware fix

[AndroidCat]

You should be safe from one-upping until someone from NASA/JPL posts... :^)

It needs to be there

[thpdg]

People read about these back doors, and they are appalled by the concept of it. I wish it was that easy. I design software for embedded devices and let me tell you, as soon as you add a password mechanism, then someone will lose the password within days. It's happened to me, and I finally had to put a global password in every machine. You hope that no one will ever find out, but once you tell a single customer, it could spread. I'm fortunate that my userbase is small and spread out, but for Cisco, this could be a disaster. If they made it so the master password could only be put in locally, that would be a big help, but may not be possible on these devices.

Re:It needs to be there

[ls-lta]

No, not really. The user id could be set by serial number (randomly) and you could keep track of who has what serial number, who is authorized to get the password, the password could also roll (think subscription revenue!).

Re:It needs to be there

[Neil Watson]

That's what reset buttons are for. A safe way to clear access without a remote back door.

Re:It needs to be there

[animus9]

Can't you just keep a list of passwords on a piece of paper locked up somewhere?

I know how hard it is to juggle a million passwords, but there has to be a better way than having a global password on each system.

Re:It needs to be there

[thpdg]

Been there, done that. If you create any kind of formula for calculating it, then that can get out just as easily. A sales rep that uses the information to help one customer, suddenly has it for every machine. We made the mistake of using that method for enabling a pay option on one of our machines.

Re:It needs to be there

[thpdg]

Reading your responses, makes me realize, I should add one thing. These devices that I work on, are for a non-Slashdot crowd. It won't spread like wildfire. More like a smoke signal on a dry day.
Cisco should have calculated the popularity of such an access key.

Re:It needs to be there

[Anonymous Coward]

There's never a need for this sort of thing (unless John Ashcroft ordered you to put it there). If you lose the password, there should be some sort of recovery procedure that a person with physical access to the hardware can execute to regain administrative control. Cisco already knows how to do this -- their routers have behaved this way for as long as I can remember.

Re:It needs to be there

[Koyaanisqatsi]

You can allways have a "reset" switch that sets your pwd back to factory default, so if the user lost it, just reset it - and have the equipment log the fact.

Then, instead of guarding a globally unique pwd, tell your users to phisically secure the equipment. Makes sense in allot of applications, like routers by the way.

Re:It needs to be there

[ndecker]

The problem with this backdor is, that it can be used remotely.
If you need to reset the password, use a jumper. Everyone who has access to the jumper can mess up the system anyway; so no harm there.
If you put a secret password into the software and tell nobody about it, somebody will read your ROM, reverse engineer the software and find your backdor.
Given the popularity of Cisco products, i wouldnt be surprised, if somebody already did reengineer their software. Somebody is going to be pretty sad about this going public.

Re:It needs to be there

[ceritus]

... someone will lose the password within days ... I finally had to put a global password in every machine

Most devices that I see come with a default username/password set that you can change and, if the admin is irresponsible enough to lose a password, the device has a mechanism (clear the NVRAM by hitting this physical button and rebooting, for example) to recover from their folly. It's a pain in the ass, but it's punishment for creating a password that you can't remember. Having a default password that cannot be removed or changed is just silly.

Re:It needs to be there

[adamofgreyskull]

It depends on the value of the information within. If it's important enough to worry about whether a master password exists...then I'd suggest that it's important enough that people will remember their password and not need it.

If I buy a 50 quid wall safe and lose my key, I could probably go into any locksmiths and get a replacement key for that model safe. If I spend 1,000,000 on a bank vault I'd like to think that no generic or master key existed...

Backing away from the analogy quietly for a moment..I think it would be pretty simple(for Cisco) to enable the backdoor login only via a console connected to the serial port and not remotely..

Re:It needs to be there

[Teddy Beartuzzi]

How about some sort of key pair system? Tech support generates a number, the customer does as well, the combo resets/changes the password kind of thing?

Re:It needs to be there

[lspd]

I design software for embedded devices and let me tell you, as soon as you add a password mechanism, then someone will lose the password within days. It's happened to me, and I finally had to put a global password in every machine.

What company do you work for exactly?

Re:It needs to be there

[thpdg]

I like that idea. Get the serial number from the machine, and then work from there. I'll have to work that into the next generation.

Re:It needs to be there

[HillClimber]

>> someone will lose the password within days. It's happened to me, and I finally had to put a global password in every machine Ummmm.... have you ever heard of a configuration reset button? You definitely didn't "have to" put in a back door. Please let me know the name of your product(s) so I can avoid them.

Re:It needs to be there

[thpdg]

Nothing mainstream, or technology oriented.
Magnatech Orbital Welding Systems

Re:It needs to be there

[FesterDaFelcher]

I design software for embedded devices and let me tell you, as soon as you add a password mechanism, then someone will lose the password within days. It's happened to me, and I finally had to put a global password in every machine.

For your own sake, why would you take on the culpability of having this in your system? One of you employees gets fired and leaks it to slashdot, and EVERY one of your clients is going to sue the shirt off your back. Do you actually tell your clients that this is available. If you do, do you wonder why youre not selling very much?

Re:It needs to be there

[Gudlyf]

I remember years ago I had some sort of networked device -- a router, whatever -- and we lost the admin password to it. The solution was to call the manufacturer, supply them with the serial number of the unit, and that would allow them to gather the "backdoor" password ONLY for that particular device.

Re:It needs to be there

[Havokmon]

Reading your responses, makes me realize, I should add one thing. These devices that I work on, are for a non-Slashdot crowd. It won't spread like wildfire. More like a smoke signal on a dry day. Cisco should have calculated the popularity of such an access key.

Cisco already provides a 'pasword retrieval' for all their routers. The trick is you have to be on site to perform the recovery.

Why there needs to be a master password that can be accessed from ANYWHERE, I don't know. At least make it only work on the current subnet.

Re:It needs to be there

[MarkGriz]

*clicks link*

"Welcome to the future home of a domain hosted by SNET Internet!"

Sweet!

Re:It needs to be there

[Glendale2x]

How about some sort of key pair system? Tech support generates a number, the customer does as well, the combo resets/changes the password kind of thing?

Isn't this how some APC products work? I only had to reset a web card once, but as I recall, tech support had me press some weird key combo which generated a number they wanted, after which they gave me another weird number to type in for the card.

Re:It needs to be there

[SpecBear]

Y'know, I've run into that situation before with routers here. Whoever it was who set the thing up left the company without passing on the info. There's a solution that doesn't involve leaving your customers bent and spread for any insider who knows the secret knock. I push a button, hold it for several seconds until the little red light stops blinking, and the device is reset to the factory defaults.

If I don't remember my login, then I'm the idiot.
If I don't backup or somehow record my device config, then I'm the idiot.
If there's a price to pay for being an idiot, I'm less likely to be an idiot repeatedly.
Sacrificing the security of all of your customers to protect some of them from paying the price of their idiocy is not acceptable.

Re:It needs to be there

[Anonymous Coward]

From his resume, don't buy products from:

The Torrington Company (Ingersoll-Rand Corporation)
Waring Products (ConAIR Corporation) New Hartford, CT

Re:It needs to be there

[gershbaz]

Major lock companies very often keep the "prints" of their secure keys on file by # so they can be re-ordered, etc. If its individualized and then say registered with a trusted third party, this is about as good as any physical security that can be purchased.

Re:It needs to be there

[thpdg]

Really? That's not good, better get after the IT guys to get that looked at. Works fine from this end.
Thank you for the head's up.

Re:It needs to be there

[thpdg]

Ha ha! I have defeated you by forgetting to keep my resume up to date! Oops.

Re:It needs to be there

[LWATCDR]

You could also only allow the master password to be used from a serial terminal and not the network connection. Also a global hardware rest that sets the master password would work as well.

Re:It needs to be there

[Anonymous Coward]

for your own sake you should make the attempt to understand the product.

its not a IT product.

so thats just making you look foolish.

welding systems are not generally networked. DUMB

Re:It needs to be there

[Artifakt]

OR at least they told you it was only for that particular device.

Re:It needs to be there

[jjackson]

There are ways around using a remotely accessible, global back-door. My embedded firewall product provides an option of booting up in a "diagnostic" mode (much like setting the configuration value for a cisco router) that boots the device without loading the configuration (hence, it does not set the admin passwords and does not enable network access).

This does, of course, require that the firewall itself be physically secured. Personally, I would rather trust someone to lock their firewall in a closet/rack than assume a remote backdoor would never be discovered.

Re:It needs to be there

[Alsee]

Or just use public key encryption. Embed the your public key in every product and have an option to spit out the customer's encrypted password. Customer calls in and you decrypt his password for him.

Of course ANY time you have that sort a capability you open potential abuses. And don't be surprised when a T.L.A. (Three Letter Agency) shows up demanding (a) that you decrypt a given password, or better yet when they demand that you simply turn over your root key so they can decrypt any password at will.

Yep, and that will be super fun if/when Trusted Computing gets rammed down our throats and the gov't gets root access to the entire system.

BTW, remember the Microsoft-NSA key fiaso? I read a more detailed EU report recently that what was happening was that 88 out of 128 encryption bits were being embeddded into the files encrypted to the NSA's key, so the NSA could read 88 bits of the passwords, reducing it to 40 bits of strength. Lotus Notes was caught embedding 24 of 64 encryption bits, again reducing it to 40 bits strength. Netscape did the same. They also compromised Swiss CryptoAG software, gaining access to military and diplomatic messages prettty much globally.

So, who still wants to buy into Trusted Computing? :D

-

Re:It needs to be there

[Brad Mace]

Network hardware doesn't need a backdoor, it needs a reset switch. Or you could plug in a console for unrestricted access. If someone has physical access to your gear, they can mess it up anyway.

The options are

1. A couple people with physical access could screw with it
2. Any wannabe hacker with net access could screw with it.

So how are backdoors a good idea?

Re:It needs to be there

[JWSmythe]

That punishment doesn't necessarly fit the crime.

I took a short (20 minute) job today, which involved fixing a customer's Cisco Catalyst 2924. There was an enable password set, but no one knew what it was. They wanted to make some network changes, most of which involved changing a couple port configurations. Zzz...

So I, not responsible for the lost password, took the "punishment" for the old admin loosing the password. Aparently the guy doesn't work for them anymore or whatever. Hell, I got paid for an hour, what do I care. :)

I hope this changes their strategy of putting in secret passwords. They're into security enough to know that is very dangerous. Secrets are not well kept, and someone will always leak.

And that username/password is

[Neil Blender]

3COMengineers/Areweenies

Re:And that username/password is

[Anonymous Coward]

Good one. Can't decide whether to mod you Funny or mod down the uninformed "Insightful" posts.

In a word...

[dj245]

Yes. If word got out they put in a backdoor so that some guy named Sisco at Cisco could root your box, their reputation would be ruined. They would essentially be the microsoft of routers, only they don't have 95% market share so they can't just flip everyone off. (Or maybe they do have 95% market share, I don't know)

I'm sure they do extensive checking against this sort of thing.

Re:In a word...

[Dave21212]

Yes. If word got out they put in a backdoor so that some guy named Sisco at Cisco could root your box, their reputation would be ruined. They would essentially be the microsoft of routers, only they don't have 95% market share so they can't just flip everyone off. (Or maybe they do have 95% market share, I don't know)

Ummmm, word did get out...


I'm sure they do extensive checking against this sort of thing.

Checking to make certain that it doesn't happen, or checking that it's in there and kept quiet ?

Ah but China uses Linux....

[Anonymous Coward]

...so that means anything they do is all right, right? When forced to choose between a Linux using dictatorship or a Windows using democracy, the dictatorship will always be first choice, eh?

Re:Ah but China uses Linux....

[Anonymous Coward]

A Windows using democracy is a dictatorship, technically speaking.

A Linux using dictatorship is a democracy, technically speaking.

Of course they still retain all the elements of their government types. Six of one, half-dozen of the other.

Be seeing you.

I am just wondering...

[Angelonio]

How many other products have "hidden" surpises.
It seems that the customer who pays for the product
is the last to know...

Re:I am just wondering...

[Anonymous Coward]

Actually,

Its a pretty common practice for alot of electronics devices to contain backdoors.

Usually only disclosed to qualified service personel under an none diclosure agreement.

A few places i have worked at wouldn't even let most of their engineers/techs have this info.

Routers/Modems/TVs/VCRs/Bios's and more have been
doing this for years.

Re:Refund? Oops

[valjean78]

Sorry, posted to quick and read 'software' as 'hardware'. Silly me.

Legal action?

[David Hume]

So what are they going to do for the people that purchased these?

Good question. Perhaps a better question might be, what are the people who purchased these going to do to CISCO?

Perhaps a legal action? Breach of contract anyone? Promissory fraud? Negligent representation?

Re:Legal action?

[Anonymous Coward]

Perhaps they could just download the patch and be done with it.

Re:Legal action?

[David Hume]

Perhaps they could just download the patch and be done with it.

True, the plaintiff would have a duty to mitigate its damages.

But what if somebody has already exploited the vulnerability?

What if the patch breaks something?

Now that the vulnerability has been announced, what if somebody exploits it before a customer hears about it or applies the patch?

newsflash: corporations exploit YOU

[flechette_indigo]

"Can we really trust closed-source venders, "?? Of course not. Isn't commerce combat? Open source is for the people by the people and corporations would sell babymeat on streetcorners if it was profitable to do so. No clues needed there. Obvious as hell.

Re:newsflash: corporations exploit YOU

[Anonymous Coward]

And open source zealots would buy the babymeat as long as those corporations were using Linux.

you trust them?

[Phrack]

Can we really trust closed-source venders, such as Cisco, to develop secure products that are free of backdoors?

Uh.. no, I don't. That's why I use ACLs to prevent the access no matter what the login is. And if the device doesn't support ACLs, the next device on the network will.

Re:you trust them?

[Manitcor]

ACLs may not neccassarily apply to an account hardcoded into an application (be it a router or a website).

You can easily, through code, create an account that would not show up in any ACL lists and may not even be logged. Once its compiled there is no way of knowing until someone speaks up like Cisco did.

At least they relseased a patch.

For the tin-foil-hat crowd out there. As a developer there are times when I will code in a superuser account during development to test different software features. It is a responsibility of the developer to remove the account and any other debugging code before making the final build. However programmers are human and are prone to mistakes.

I would be more inclined to belive that it was something that was either missed on accident or was maliciously added not by Cisco but one of thier developers independantly, for whatever reason. Im betting either way whoever it was is no longer employed at Cisco.

Re:you trust them?

[Anonymous Coward]

Actually, I'm guessing it's in there for support personnel so they can make changes remotely for clients who are clueless.

Re:you trust them?

[Phrack]

Certainly plausible, but it doesn't matter. Logins, hidden or otherwise, are immaterial if the device is not reachable.

There's only so many methods of access. It's quite easy to drop all traffic destined TO the router except for management (vty, snmp) traffic from your management hosts and your local routing protocol. Heck, you can go to serial console only management, but that's a real pain in a large scale environment.

If your local network admin hasn't at least applied access-classes to the vty, snmp. http and ssh services or turned them off entirely, fire him. That's the very least that should be done.

And if you just don't want to bother with them anymore, use Quagga (http://www.quagga.net). OS hardening applies.

USER/PASS

[Allen Zadr]

Don't some of us have some serious hacking to do? I guess I know what you are planning on doing this weekend.

What do you bet the id set is joshua/pencil?

Re:USER/PASS

[FurryFeet]

Wrong. That would be Falken/joshua. "Pencil" was the high school password.
And I'm a major dork.

You can't trust ANYONE.

[CrystalFalcon]

Can we really trust closed-source venders, such as Cisco, to develop secure products that are free of backdoors?

You can't trust open-source for this, either. Not unless you personally constructed every piece of the device, from the source code, to everything that interacts with the source code, including the compiler, the EEPROM burners, and the chipsets on the device itself.

How do you know that the open source you are looking at actually is the one running in your device? You don't.

How do you know that the code you are looking at, assuming that it is running in the device, wasn't modified by a malicious compiler? You don't.

How do you know that the compiled code, assuming it is compiled correctly, wasn't altered in the transfer to the device? You don't.

How do you know the other onboard chips aren't built with a backdoor, patching, hooking or circumventing whatever code is put in the device? You don't.

What it boils down to is that trust is a very difficult animal, and at some point, you need to draw the line. Looking at the source is a meager guarantee for the device behaving well, in the case of a malicious vendor.

The bottom line is that there are so many covert channels to insert code into your overall system today, as long as they are carried on the normal device acquisision channels, that you can't defend against an attack by a malicious vendor. What you can do is to count on their risk analysis, and expecting them to want to stay in business just as much as you do. It's not much, but it's pretty much the best we got.

Re:You can't trust ANYONE.

[xpl_the_myst]

You sound like a Palladium proponent!

Re:You can't trust ANYONE.

[bgog]

How do you know that the open source you are looking at actually is the one running in your device?

You compile it yourself.

How do you know that the code you are looking at, assuming that it is running in the device, wasn't modified by a malicious compiler?

True, but highly unlikley.

How do you know that the compiled code, assuming it is compiled correctly, wasn't altered in the transfer to the device?

Because I transfered it. Perhaps via serial cable or over a cable not on a public network.

What it boils down to is that trust is a very difficult animal, and at some point, you need to draw the line.

I draw the line at blatent backdoors. The difficulty of breaking into my router by giving me a bad compiler is FAR FAR FAR more difficult than a backdoor admin account. Once that gets out anyone can log in and do what they like.

Re:You can't trust ANYONE.

[ScrappyLaptop]

Um, checksums? You get the code from a trusted source and compile the source yourself? You know: config make make install Try it, you'll like it! The only place this won't work is firmware that you don't flash yourself. However, for that there are MD5-type solutions. You know, when you go to download and there is that tiny little file that just has a line of gibberish in it? Hell, they work great for compiled software too...

Re:You can't trust ANYONE.

[C3ntaur]

Not unless you personally constructed every piece of the device, from the source code, to everything that interacts with the source code, including the compiler, the EEPROM burners, and the chipsets on the device itself.

And do you even have this option with closed source? You don't.

Believe me, if the end application is valuable enough, someone will take the time and effort to run down the entire audit trail you described, if given the source code to do so. Personally, I like having the option. Trust, but verify.

Re:You can't trust ANYONE.

[pclminion]

You can't trust open-source for this, either. Not unless you personally constructed every piece of the device, from the source code, to everything that interacts with the source code, including the compiler, the EEPROM burners, and the chipsets on the device itself.

Even that's not good enough. It isn't enough to have the source -- the source code might say something like "write zeros over entire disk on April 10, 2004" and you'd never notice it. Who the hell actually reads the source code before compiling it? Of the people who do, how many are skilled enough to actually recognize a very clever back door?

Has somebody ever sent you a helpful bash script for some common administration task? Did you actually read the script, to make sure there's no line in there saying 'rm -rf /'?

I can blow you up with a stick of dynamite. Or I can send you a recipe for making "Ted's Delicious Cookies" which is actually a recipe for dynamite, and hope that you're stupid enough that you'll blow yourself up. Except with source code it's much easier to conceal nasty things.

Re:You can't trust ANYONE.

[NineNine]

You get the code from a trusted source and compile the source yourself?

There's that word again... trust. You have to trust the source. Call me nuts, but Cisco is pretty damn trustworthy. Compiling yourself won't get you anywhere except knowing that that chunk of code you downloaded is what you're running. But then, you don't know what you're running unless you read and understand each and every line of code.

Re:You can't trust ANYONE.

[agurkan]

there are good answers already but here are my two cents:
1. Installing a backdoor in my compiler or my connection to the device is way harder than installing a backdoor in binary code.
2. I do read source code, anybody installing a router for critical missions should also be able to do so. It is not that hard to read, and I think it will be easier to remove backdoor than writing a clever one so it won't be spotted easily.
3. MOST IMPORTANTLY: If this happened with open source, we would have a chance to fix it as soon as we learn about it. There would be no need to wait for the vendor.

Re:You can't trust ANYONE.

[StealthHunter]

Search google for "Reflections on Trusting Trust" it's a great ACM award speach by Ken Thompson about this very topic. try here

Re:You can't trust ANYONE.

[Valar]

A lot of this kind of discussion came up in one of the recent e-voting stories. The problem is, if I use an open source compiler (assuming the code is audited by a non-malicious party, in the worse case, me), then you would have to resort to a hardware based attack (i.e. the device essentially 'patches' in the exploit). Of course, this is a lot harder than people seem to think. What if I, for example, compiled it with a compiler that used stack and memory map randomization? The hardware would patch over the wrong functionality. Suddenly, the router would not function as intended and it would be obvious that shenanigans were occuring. So then, the hardware would have to have a totally seperate control system outside of what was availible in the software. It might, for example, interpret certain seemingly normal sequence of packets as a command to send back some naughty data. BUT all the logic would have to be implemented in hardware, which would lead to a noticable increase in development and production costs. In fact, I think that from a practical standpoint, a complex backdoor system would far overshadow the actual engineering work for the router itself.

Re:You can't trust ANYONE.

[Anonymous Coward]

Ummm... How do you know that your compiler didn't insert a trojan into the binary... Oh, right, you compile it yourself... With what?

Re:You can't trust ANYONE.

[sfe_software]

there are good answers already but here are my two cents:
1. Installing a backdoor in my compiler or my connection to the device is way harder than installing a backdoor in binary code.
2. I do read source code, anybody installing a router for critical missions should also be able to do so. It is not that hard to read, and I think it will be easier to remove backdoor than writing a clever one so it won't be spotted easily.
3. MOST IMPORTANTLY: If this happened with open source, we would have a chance to fix it as soon as we learn about it. There would be no need to wait for the vendor.

I think there's one more:

4. Even if you don't look at (or understand) the source code, and I don't, and noone reading Slashdot does... someone, somewhere, will if it's in relatively wide distribution.

Re:You can't trust ANYONE.

[Carnildo]

>> How do you know that the code you are looking at, assuming that it is running in the device, wasn't modified by a malicious compiler?

> True, but highly unlikley.

It happened. All early versions of Unix "login" had a backdoor password. The C compiler had a set of hidden routines that, when it recognized a recompilation of "login", would inject the backdoor code. Further, if it recognized a recompilation of the compiler, it would inject the backdoor creation routines. None of this showed up in the source code.

Re:You can't trust ANYONE.

[Anonymous Coward]

How do you know that the open source you are looking at actually is the one running in your device?

You compile it yourself.

Do you look through every single line of the the source for every single program you compile?
Thought not.

Re:You can't trust ANYONE.

[agurkan]

you are referring to reclections on trusting trust. you are highly exaggerating though. the only reliable reference to an actual incident I found is in the jargon file, but even that is a tongue-in-the-cheek expression. This was not distributed, certainly not to all customers which purchased early versions of "Unix", which is the implication I get from your post.
It would be even harder to do with gcc/glibc as there are many environments where gcc is compiled with the native compiler of that platform, e.g., Solaris. You can check even for Linux though, compile gcc in Solaris, then cross compile gcc to Linux using the gcc you compiled in Solaris, then compile the gcc source with your cross compiled product. and finally compile gnu C library, if there is any malicious code that is inserted by a crooked compiler, it will show.

Re:You can't trust ANYONE.

[StrongAxe]

How do you know that the compiled code, assuming it is compiled correctly, wasn't altered in the transfer to the device?

Because I transfered it. Perhaps via serial cable or over a cable not on a public network.

True; however, how do you know that what you transferred is actually running on the device? Unless you actually compiled the code in the boot ROM that does the download, you can't be sure that the code isn't being altered as it is downloaded. Even so, unless you know every other chip and every trace on the device's motherboard, you can't be sure that there isn't something else going on that could subvert your intentions.

Re:You can't trust ANYONE.

[Anonymous Coward]

Everyone should read Reflections on Trusting Trust before arguing too much on this topic...

Re:You can't trust ANYONE.

[Anonymous Coward]

Since nobody takes that time and effort, there must not be any end applications that are considered valuable enough.

Re:You can't trust ANYONE.

[shaitand]

"How do you know that the open source you are looking at actually is the one running in your device?"

Since you umm have the source, you compile it and either image the device with your copy or you compare md5's or some such?

"How do you know that the compiled code, assuming it is compiled correctly, wasn't altered in the transfer to the device?"

Same way?

"How do you know the other onboard chips aren't built with a backdoor, patching, hooking or circumventing whatever code is put in the device?"

Simple, you require the hardware be open as well as the source. Keeping inferior technology alive by keeping advancements that belong to the human species rather than those who happen to discover them FIRST (rarely is something only discovered once ever)secret is a buisness model which needs to be ended. All products should be completely open before hitting the market, forcing companies to continue to innovate and advance their products to stay ahead.

Re:You can't trust ANYONE.

[bgog]

Yes yes... I am not implying that there is any way to really be secure. I point is simply it's a hell of a lot harder to mess with me using the methods parent mentioned than to just exploit an intentional back-door.

yep

[SHEENmaster]

look for openbsd's corporate usage page.

Re:yep

[Vancorps]

sorry but that is not a replacement for something like a cisco router or switch. I'd say this is a boost for Nortel and HP.

Re:yep

[MyGirlFriendsBroken]

This page can be found here and is about 1/3 of the way down the page.

and when you log in, you get...

[funny-jack]

Greetings, Professor Falken.
Shall we play a game?

Re:and when you log in, you get...

[Anonymous Coward]

Sure Joshua, "Global Thermal Nuclear War"

Back to the good old days for hackers

[dan dan the dna man]

Hmm yes, like when SGI shipped their machines with much the same problem. Has nearly a decade of fighting computer intrusion taught them nothing. Thats pretty shoddy Cisco.

Register, or else

[skidde]

The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/1105-h ost-sol ( registered customers only) .

I love when companies release vital updates or other material, and then effectively force registration of all their clients. So either register with the mothership, or deal with a vulnerable program? Great.

Re:Register, or else

[ph4s3]

RTFA moron.

It clearly states that customers without support contracts or with uncooperative 3rd party vendors can go through the CISCO TAC (number listed on reference article) to get the proper patches.

Everyone affected, assuming they at least have the serial number still on the box, can get the patch, which is The Right Thing To Do(tm).

Re:Register, or else

[ThisIsFred]

Well, Cisco generally charges for a support contract before you're entitled to any firmware updates. Another reason not to use Cisco. OTOH, Cisco hardware doesn't die if you look at it crosseyed, so it's a tough choice I guess.

Re:Register, or else

[Zeddicus_Z]

Cisco is positively benign when it comes to updating vulnerable products.

The worst company I've personally had experience with is ISS and its network security offerings (BlackICE, RealSecure etc).

Over the past few months there has been, from memory, two problems affecting ISS' BlackICE firewall family (there's more than one type of BICE). In both cases authors of the bugtraq posts originally outing these vulns stated that "patches are available" and could be downloaded from [location]. On going to said location however, all that was available from ISS was newever versions of the entire program, NOT patches. And here's the kicker - to install these newer versions and thus protect against inevitable exploit, your CD key (and thus account) had to be less than 12 months old! If you purchased your copy of BICE more than 12 months prior, you were Shit Outta Luck.

Cisco may be annoying to deal with on occasion, but at least they're not engaged in extortion by forcing customers to pay for critical updates, the sole purpose of which is to FIX CRITICAL FLAWS IN THE ORIGINAL PRODUCT! (who me angry?)

The first time I ran across ISS' shabby treatment of its customers I dropped them for a different vendor. The second time around Witty hits, and you have no idea just how greatful I am I dropped ISS and their shady business practices in the first instance.

Great, a homophobic loser with a broken website

[Anonymous Coward]

Thanks for that invaluable link.

The answer is no.

[rice_burners_suck]

Can we really trust closed- source vendors, such as Cisco, to develop secure products that are free of backdoors?

The answer is NO. We simply cannot trust closed-source vendors of any kind.

Think of it this way: Any kind of physical machine that you can get can be taken apart and inspected. But when it comes to software, which has grown in the last decades to very large and complex systems, doing so without the source is extremely difficult and wouldn't give any benefit because the results could be impossible to understand.

Therefore, RMS is absolutely right in this respect, no matter how wacko some people think he is.

Re:The answer is no.

[goldspider]

And what, praytell, makes open-source so much more secure?

You'll come back with something along the lines of "people can look at the code and find vulnerabilities".

But who is going to painstakingly inspect every line of code in every piece of open-source software he/she comes across? How can we trust that they will fix an exploit they find rather than use it themselves?

As embarassing as this is for Cisco, they have people who do nothing but test code. The fact that they let this one pass doesn't take away from the fact that closed-source software by and large undergoes far more thorough testing than open-source, and that's where I'm putting my money until you can prove to me that I should trust the commune over the corporation.

Re:The answer is no.

[Geoffreyerffoeg]

But that wouldn't be trusting the vendor. That would be knowing there are no back doors. Trusting would be exactly that: being able to place your trust in the vendor without using the back doors.

RMS may be right that closed-source products may have security holes. But if, say, one of my friends wrote a closed-source product that handles security, and I were confident of his/her programming skills, I would be able to trust there are no intentional security holes.

Very few people actually inspect each line of open-source software, so we are still trusting them. Logically, it makes less sense to trust open-source vendors, since they place their code in the open knowing that statistically not many will inspect/suspect it for security holes.

Re:The answer is no.

[Queuetue]

I can tell from your post that you're not a thinking man, so I'm really posting this for anyone who may read and believe your non-argument.

Yes, OSS get scrutinized - often every line. Because every person out there who for whatever reason is *interested* in how a printer driver or IO toolkit works can pull it apart and learn to understand it. And while they're in there, they add to the percentage chance that a bug will be found and an explit patched. Keep adding those little percentages together, and you approach 100% - "given enough eyes, all bugs are shallow."

In addition, OSS software undergoes immense testing. It undergoes testing by the user/developers who can see the source, which helps them figure out where to push and how to break it, and by the end users, who enjoy long public beta cycles with open defect tracking logs, so they can see, report and vote for bugs - and understand what milestone or version they will be fixed in.

And finally, if commercial companies presented the source to thier software, how would that affect ho wmuch testing they would do on it? Logic would indicate that the two would have no bearing on each other - because the source is open, they would stop testing it?

Re:The answer is no.

[sqlrob]

Yes, OSS get scrutinized - often every line. Because every person out there who for whatever reason is *interested* in how a printer driver or IO toolkit works can pull it apart and learn to understand it. And while they're in there, they add to the percentage chance that a bug will be found and an explit patched. Keep adding those little percentages together, and you approach 100% - "given enough eyes, all bugs are shallow."

Which does *NOT* necessarily mean a short time period.

How long was the admin username/password in Interbase after it went OSS? Year and a half or so? Doesn't get much more blatant than that.

How long was that double free in zlib?

Re:The answer is no.

[Queuetue]

Zlib? from 1.0.8 to 1.1.3, so around 2 years.

Interbase, no idea - a default password isn't really a source defect, though, and it was both known and intentional, so I guess it was found instantly.

WLSE 2.0 appears to have come out in '02, so it looks like the defect longevity is running neck-and-neck with zlib - a project that the grandparent refered to as 'commune' software.

And then there's the other issues - namely, Cisco did this one intentionally (a backdoor isn't a bug - and it isn't public like a default password.) and they charge between 5 and 9 thousand dollars a pop for it, and they require you to register for the fix.

I'm not knocking cisco - they make a reasonably good product, but arguing against transparency in the code of such a mission-critical product doesn't make any sense. If there were even just a handful of eyes on this product, this problem would have been found.

Re:The answer is no.

[sjames]

But who is going to painstakingly inspect every line of code in every piece of open-source software he/she comes across? How can we trust that they will fix an exploit they find rather than use it themselves?

It's just a matter of odds. Nobody is likely to examine every line of all source they use. However, if the source is out there, there are decent odds that someone will spot the problem.

We can argue all day over what those odds are, but it's fairly clear that with Open Source (or better, Free Software), there's a much better chance that sombody who has no vested interest in keeping quiet will spot the problem and report it than with proprietary software.

After all, Cisco products aren't exactly obscure.

Re:The answer is no.

[sqlrob]

Interbase, no idea - a default password isn't really a source defect, though, and it was both known and intentional, so I guess it was found instantly.

It wasn't a default password, it was a hidden account with a hardcoded password. And it was 1 1/2-2 years (after opening. Don't know how long before), *NOT* instantly. "Many eyes" only work if there are many eyes, not could be many eyes.

Re:The answer is no.

[Queuetue]

Oops - you're right on that one, and I'm wrong. I didn't (and still don't) know anything about Interbase, except that they managed to whine enough to get mozilla to change their browser's development name. I don't even sure why I assumed it was a default password problem, except that it helpmed make my point :)

1 1/2 is still less than my projected 2, though, so OSS is still neck-and neck (and better on average in this tiny and meaningless sample) with proprietary software.

Re:The answer is no.

[BillyBlaze]

But who is going to painstakingly inspect every line of code in every piece of open-source software he/she comes across?

People who want to exploit it, of course.

How can we trust that they will fix an exploit they find rather than use it themselves?

We can't. But we can trust that when you put software into the wild, people will try to exploit it. So why can open source be more secure? Because it's easy to find exploits if you have the source, and it's hard to find them if you have only the binary.

Imagine two identical programs, one open and one closed, each with 100 exploitable bugs. A group of crackers look for bugs in the closed version, finds 25 of them, and exploits them. The company fixes them, and they're down to 75 bugs. In a parallel universe, the crackers look for bugs in the source of the open version, and find and exploit 75 of them. The community fixes them, and there are 25 bugs left. The open version has become more secure.

You may say the company's testing would find 50 more bugs. But I don't think they can employ enough testers to out-do the entire cracker community. You may say that the open source version had three times as many exploits. That's true, but those were in the past, before the product was mature. At this point, both projects have reached an equillibrium between the bugs created and bugs found, and the open source version has fewer bugs.

Another factor is that with closed source, the only external people interested in finding bugs are those that want to exploit them. With open source, those few people who are just really bored and want to help have the tools, namely access to the source, to do so.

Does Cisco know wha'ts going on?

[myst564]

Let's see..

"Although Cisco cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability."

This is probably a standard disclaimer in their security documents, but wouldn't you want them to be sure of the accuracy of their statements?

Why can software/hardware companies get way with "We tried our best, honest!" ?

Re:Does Cisco know wha'ts going on?

[Geoffreyerffoeg]

How can they do better? The phrase "best of our ability" means they cannot be surer of the statements' accuracy. They can get away with "We tried our best" because they cannot have tried harder.

Re:Does Cisco know wha'ts going on?

[Anonymous Coward]

Exactly. It's customers expecting more than is possible that leads less honest companies to make guarantees and promises.

That statement in Cisco's document no doubt originated from an engineer, interested in relaying information, not the marketing or legal departments whose talents lying in spinning and obscuring.

Re:Does Cisco know wha'ts going on?

[Anonymous Coward]

There are laws in other fields.
If I build a jet "the best that I can", I certainly wouldn't be allowed to sell it, at least in the US

Re:Does Cisco know wha'ts going on?

[rob_kg]

Dude, this stuff has all to do with lawyers. Almost everyone that releases an advisory has such a disclaimer because they might get sued by other companies if there is anything untruthful about other companies' products or something..
You can't know for sure for what stupid little thingie people will sue you these days..

Re:Does Cisco know wha'ts going on?

[ScrewMaster]

Why can software/hardware companies get way with "We tried our best, honest!"?

Why not? NASA does.

accident ?

[Anonymous Coward]

I wonder if they put this backdoor in on purpose or if some evil programmer added it when noone was watching. I don't think the latter is very likely as you'd think they would have noticed that sooner. If they knowingly put this in, I wonder what their motivation was to do so. They must have known that if the username/password would leak, the impact would be huge.

Re:accident ?

[Le Marteau]

They must have known that if the username/password would leak, the impact would be huge.

One would think. I figured Cisco stock would be in for a hit today, but at the close, it's only down 0.37%.

That's why I've stopped playing the market. What makes sense to me does not make sense to the market, and vice versa.

Re:accident ?

[SnappleMaster]

"What makes sense to me does not make sense to the market, and vice versa."

Your problem is you assume that everyone who participates in the market is as intelligent as you are and values the same things in the same ways.

Sometimes the market makes little sense but some times if you think like a drooling idiot who cares only about the big number at the bottom of the financial report you can make some accurate predicitions.

to match the luggage combination

[discogravy]

admin/12345

Joint statement from a couple of the best

[tuxathon]

Cisco in no way represents the rest of us in the proprietary software industry. We in no way have or condone software backdoors.

Bill Gates, Microsoft

Rob Glaser, RealNetworks

Oh, c'mon,

[2names]

mods, that was funny...

Insane but not unique

[jmcnamera]

This is mind-blowingly insane. Its bad enough when products come with a default name/password or open login like the old MS SQL 7.

However, this wasn't an uncommon practice once. We had this in a product from Data General, but that was mid 1980's and we changed it later when we woke up to how stupid it was.

Ok, almost as stupid, I know of hardware systems which have backdoors where if you know the key generating algorithm you can take the challenge string from the system's UI and generate the password from it. The math is simple and can be done in your head. The algorithm had to be changed once when it leaked out but it was still simple to do the new one in your head.

However, Cisco of all folks have seen security disasters in other's and their own products over the last few years. They should've fixed this and stopped doing it already.

**sigh**

Linksys...

[Lugor]

hm... does this affect Linksys wireless too?

Re:Linksys...

[DR SoB]

Does it say CISCO anywhere on it???

Re:Linksys...

[Anonymous Coward]

yes, Linksys devices are cisco...

Re:Linksys...

[DR SoB]

So apparently the answer is...... (damn these AC's are slow)

Re:Linksys...

[ODD97]

Yes, the linksys router I bought last week has a cisco logo on it. Thanks for playing!

Gimmie a break!!

[evil-osm]

Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?

Gimmie a break, they likly made a mistake, and you never have? They admited it and have issued an advisory (mind you it looks worse if found out by the public later on, which may be the case this time as I didn't rtfa). In a case like this I'd return the product if I couldn't remove the uid and pass. "Sorry, its got a major problem with it, I don't want it". Simple as that.

No,

[2names]

truly an American Idiot.

"...I just can't take the money, bitches and fame anymore...-BLAM!!!..."

What a jackassed coward.

Re:No,

[hyperstation]

fuck you sir, and have a little respect on the anniversary of the day the man's body was found.

the jury's still out, so you might be insulting a victim of murder...

Re:No,

[Anonymous Coward]

Who gives a shit? He was a fucked up loser anyway.

...my school's internet?

[queenofthe1ring]

wide-spread failures? denial of service?

sounds like wku has cisco's internet software...

A better question

[Anonymous Coward]

Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?

How can anybody over the age of 10 be so naive as to even think of asking that question?

The government

[Fuzzums]

still has access to all the systems everywhere. don't they?

Why reveal it?

[z00z]

Any idea what prompted them to reveal this backdoor? Did somebody hack it?

MOD PARENT UP!

[hot_Karls_bad_cavern]

It is simply, unFUCKING believable that companies and people are STILL doing this kind of shit. Has any of these morons ever heard of Cliff Stoll or read his book? Or know anything about how FUCKING STUPID backdoors are?

Truly amazing these people make things that are trusted to run the financial infrastructure of this country.

Re:MOD PARENT UP!

[sjames]

One must wonder, how many other network products have these gaping holes in them?

While some have wondered if it was a backdoor for law enforcement, I question the effectiveness of that. After all, it destroys all arguments in court that nobody else could have been in control of the router at the time. Now it's more like nobody but the admins, and all the kiddiez on IRC everywhere could have been in control of the router.

That means that the sniffed traffic is nearly meaningless.

If it does 'need' to be there

[*weasel]

Simply add a 'reset' button. Or something like that handy little jumper you can switch on your motherboard in case someone forgets a bios password.

A backdoor as cisco has is unacceptable in every way.

Re:If it does 'need' to be there

[thpdg]

Unless you're in an environment where opening the machine to access it, is impossible, or dangerous to the equipment. In the case of the Cisco equipment, they could all be stashed in remote locations, that are rarely visited. (I realize this is really no excuse, of course)

Workaround vs. Software upgrade

[ericspinder]

A workaround is a configuration change a user makes with the existing software, a software upgrade is, well, a software upgrade. Some admins would rather use a quick workaround on a production system instead of taking the chance that a software upgrade will introduce a new bug.

Will I ever have fun tonight!

[xutopia]

That boss of mine whom I hated told me that CISCO was the best. I told him it wasn't!! We'll show him now!!!

WLSE runs Linux kernel

[fwr]

In case you didn't know. I tried to get the source from Cisco but ran into a lot of hassle.

But, you're giving away all our best tricks!

[b00m3rang]

"They're not tricks!"

Mr Potato Head

[cflorio]

Backdors are Not secrets!

You have to understand bug-fix parlance...

[Vellmont]

A workaround is a simple method of fixing the problem without patching the software. Usually it involves configuration changes, disabling parts of the software, or even firewalls. For this particular problem it's easy to see why there's no workaround.

The fix is a software patch. Many admins prefer a workaround as a short-term solution (can change simple config in a few minutes). A software patch is obviously more complicated, and often has higher impact on other services.

backdoors are cool

[ToadMan8]

dude... backdoors are cool; it's that cloak and dagger shit I am too young to have been able to participate in. Knowing your shit when it comes to computers was much cooler when there were no laws that said hacking was bad. HACK THE PLANET!!!
OK, back to reality now, yeah, that's pesky... back to using the old desktops as routers now. Oh well.

Just in time.

[JohnLi]

Maybe they considered it an Easter Egg???

I told you so.

[DR SoB]

Now bow to me, your new overlord (at least until the next /. topic is posted!)

Cisco is not alone. It's industry wide practice.

[lotussuper7]

I have worked for 6 or 7 different companies that build either comm boxes or control software, and each and every one has had built in backdoors.

It's not just Cisco, it's a common practice in the industry to give their field people a way to get into the box (or program) when the customer screws it up.

Backdoors that, often, have access to functions far beyond what the customer knows about, and in many cases, able of really messing up the device if used incorrectly by a tech who is not an expert.

On the flip side, I was working as a level 3 tech for one now out-of-business large computer company, and it was not uncommon to get a call from a customer asking if we could break into a box and reset passwords for them since they had "lost" the passwords. They need to get access without doing a full reset and losing the configuration information since the box is in a production environment.

So, they put a modem on the diagnostic port, I dial in, do the magic, and make the customer happy.

So, yes, it is a security hole, but it is also something that customers are happy about when they need it.

Cisco acqusition

[lsw]

Could be the case that this product was acquired by another company rather than developed by CSCO? It's my understanding that they buy lotsa startups, so there could be a backdoor in this line of products but not necessarily into everything that CSCO makes.

It could also be possible that the backdoor was inserted a long time ago (before the acquisition?) and then left there, till someone found out.

I'm a script kiddie. I do this stuff in real life.

[Anonymous Coward]

Lets just imagine someone posts in a messageboard, or chat room, that they're having problems with their DSL modem.

"Can someone help me, my laptop won't access the Internet but my desktop will."

"What are you using to get on the Internet?"

"You mean like cable or DSL?"

"Yeah"

"Oh I have DSL"

"What kind of modem is it"

"BitTronics 200M"

"Hrm...."

Then you bullshit with them for a little, have them ping the gateway, whatever. Meanwhile, you're on BitTronics website, downloading the PDF file of the manual for that modem.

Two minutes later, you've used the default name/password to get in the modem, and you can do a number of things. Upload a garbage file for a firmware update, and hose it, disable routes, shut ports off...While you're in there, most routers/modems will let you telnet to other hosts on the LAN. Time for fun with HP JetDirects!

What do you do next? Do the same thing to the whole block of IP's, since more than likely, they've all got the exact same modem.

Speaking of Doors....

[Jtheletter]

Well I'm a back door man!
I'm a back door ma-an!
The consumers don't know, but the Cisco guys, they understand!

Sorry, I felt the need. Jim Morrison may be rolling in his grave, but that's only if you can hear me actually "singing".

Eventually every back door has to be used...

[stienman]

Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?

Yes. They have to keep an eye out for their customers. However, there are two ways of getting around this:

Password can only be entered while someone is physically present - so you have to press a button on the device, then login with back door in the next 30 seconds. This proves access, and any company that has poor physical security is not likely to care about network security.

Second use challenge-response password mechanisms. This prevents a 'global' backdoor, while still giving the manufacturer the ability to gain access. The user enters a generic name/pass ("lost", "password") the machine then responds with a 128 bit (hexadecimal) number (randomly generated) and the user provides both the serial number and this random number to the company. The company responds with a correct response (another 128 bit number, perhaps) and the device allows access.

Combine either or both of these two methods with a "reset configuration to factory defaults when back door is used" and the company can claim that they are as secure as can be, without preventing the occasional user complaint that the hardware is a doorstop because some subadmin made a mistake changing the password.

-Adam

Re:Eventually every back door has to be used...

[gershbaz]

I absolutely agree -- but some sort of public/private key mechanism could also be put in place. Two-part unique private keys generated for each box -- one for the customer, and one to be held by the provider. Both would need to be used simultaneously against the key of the box in order to gain access. Sure, what if the customer loses the private key? But what if the customer drops the box in a lake? You can only protect people so far.

Yes, but - WIRELESS

[Allen Zadr]

The problem here is that these routers are WIRELESS. All you need is proximity to use the secret ID. Block my MAC, I tell my MAC to use another address. Block all wireless, then what's the point of having a wireless product.

The advisory (that link in the story) was pretty clear that there isn't a way to disable the use of this backdoor without a firmware upgrade.

Re:Yes, but - WIRELESS

[Pii]

For starters, we're not talking about "routers" at all, smart guy.

Second, your proximity to a wireless device doesn't mean you have administrative access even to the device you are associated with.

As has been pointed out repeatedly in this thread, access to the administrative interface of Cisco devices can easily be restricted through the use of a simple Access Control List.

I could give you the vty (telnet) and enable passwords to 100s of devices I've set up that are connected to the Internet right now, and there's not a damn thing you'd be able to do to them.

This entire thread is much ado about nothing, and most of the comments I've seen are either from the agenda driven, or tragically misinformed.

Re:Yes, but - WIRELESS

[PReDiToR]

Or only allow whitelist MACs?

This is probably to comply with the FBI regulations on Carnivore or something like that ... All WiFi comms must have a backdoor accessible to law enforcement.

I painted my other tinfoil hat black, now it looks like a ski mask.

CRAZY MOD ALERT !

[Anonymous Coward]

4 people jumped in an corrected this, but for some reason it keeps getting bumped up!

Recovering passwords

[vasqzr]

I was called by a apartment complex that offered broadband to tenants. Apparently, one of the kids (mostly college students) had taken a networking class or something, and telneted in to the switches, and screwed a bunch of stuff up.

Of course, he changed the password to who knows what, so we had to call Nortel up and read them the serial number from each switch, and they gave us a backdoor password. I belive it was generated by a program they had. We had to verify proof of purchase and everything with the company, but who couldn't forge a Invoice from CDW or Insight?

Re:Recovering passwords

[cgenman]

Of course, he changed the password to who knows what, so we had to call Nortel up and read them the serial number from each switch, and they gave us a backdoor password. I belive it was generated by a program they had. We had to verify proof of purchase and everything with the company, but who couldn't forge a Invoice from CDW or Insight?

Now, what's the most likely way that the kid got into the switch?

I like the idea of a physical switch that temporarily enables a backdoor password. Physical access = access is compelling. But having a backdoor that is accessible at any time, simply by knowing the right code or by being able to sound convincing on the phone just doesn't scream security.

Re:Recovering passwords

[vasqzr]

They had telnet enabled...we shut that off, now the only way in is with a serial port connection, and you need the key to the maintenance room, and the server cabinet key.

Not unless by "Linksys" you mean "Cisco"

[b00m3rang]

But seriously, it only affects WLSE and HSE software, my brief investigation tells me this is not the software that the Linksys devices run. Someone correct me if you have contrary evidence.

So what

[thebra]

my apartment has a front door and that doesn't suprise me, but seriously...
I can't say that I'm shocked by this I'm sure they just wanted an easy way to help users with their hardware if the really screwed it up but it looks like Cisco has screwed up.

Ever dealt with Cisco? Personally?

[Anonymous Coward]

We maintain a very substantial annual contract with Cisco. I can tell you that while our service has varied a bit in terms of engineering skill over the years, overall it has been outstanding. They maintain, by and large, the most thoroughly documented product base of any major hardware vendor.

Second of all, when you read those two bug toolkit ID's, you will notice that there are patches directly available to fix the problem. Oh no, not a patch. Pfffft.

Taliban Master-Plan to Destroy America

[Progman3K]

>Just like we can't trust closed-source e-voting software [when] it comes to our republic (the U.S.:), we can't trust close-source vendors whose systems power our infrastructure...that, without, the world would cease to function as it does today.

Taliban leader speaking:

OK troops, here's what we'll do; we will sub-contract from the Pakistanis that are sub-contracting from the Indians that are sub-contracting from the Americans that are outsourcing their I.T. operations, and when WE are the ones coding everything for the Americans, we slip in trojans, viruses and everything else we can think of to screw with their heads!

Once they are all helpless because they've outsourced all the jobs that require an education, we show up and sell them all Edsel automobiles and when they've all killed themselves on the road, we simply take over the country.

Simple.

Re:Taliban Master-Plan to Destroy America

[LostCluster]

Seriously, whenever you go outside of your company (not even internationally) to get custom programming and you don't get to see the source... you might as well ASSUME there's a backdoor that your vendor has left in there. You'll never be able to prove otherwise, afterall...

The only totally secured application is one that you're able to inspect the code yourself. That doesn't have to be fully GPL Open Source, but the code at least has to be open to you. Otherwise, you're just taking somebody else's word for it being secured.

Interbase backdoor anyone?

[i_am_pi]

The interbase backdoor wasn't found for quite a few years, and only then because the thing went open-source. Could it be that companies are stopping themselves from going open because it would reveal their backdoors?

Re:Interbase backdoor anyone?

[0x0d0a]

And the code that they don't own that is in their codebase. Going open source requires a serious belief that your code is legitimate.

Just because Cisco had a backdoor doesn't mean

[b00m3rang]

that other vendors don't also. The two aren't mutually exclusive, and this event does absolutely nothing to prove that other vendors are any more trustworthy than they are. Possibly the other vendors are just quieter about the issue.

Re:Just because Cisco had a backdoor doesn't mean

[xutopia]

or perhaps software to run such machines should simply be open source so we know for sure.

Re:Cisco is not alone. It's industry wide practice

[gilesjuk]

Indeed, it's a common way of letting support staffs fix products. But I'm a little surprised it is still going on.

BIOS passwords

[Anonymous Coward]

Hmm.. It seems like people are overlooking the BIOS backdoors that used to be put in (still are?). Not ever having used the WLAN feeature on my systems, isn't this an old issue on a new(er) device?

Rolex comparison??

[bstadil]

someone will lose the password within days

Ever occured to you that the reason it get lost is that the perception is it has no value.

How many people loses their new Rolex within a few days? Let them pay for the cost of a Re-setup

The argument that this will lead to shoddy safety internally as the password will be written on a Stick-it note on the box, is not valid. They have themselves to blame and the risk does not get foisted onto someone else.

No it doesn't

[Burdell]

There is no reason to have a master password that gives someone with that knowlege instant full access to every such device in the field. There are many ways to work around it (without resorting to just resetting the device and clearing all settings).

Cisco IOS routers don't have to have a "master password" backdoor; they have a well-defined process for password recovery (typically you connect to the console port, interrupt the boot at the firmware level, and change a register - then you are in with no password and can reset it).

Another example: Livingston PortMasters also don't have a "master password" backdoor. You hook up to the console port, flip a dip switch and use a special login. That issues a challenge string, which you then send to Livingston (or now portmasters.com). You get a respose string and use it to log in, and then you change the password.

The common assumption is that full physical access implies ownership; that is a reasonable assumption (since if someone can get at it, they can take it).

No

[jc42]

Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?

Simple question, with an even simpler answer: No.

If you want to be wordier, you can make the general statement that the reason for closed source is that there are things in the source that the vendor doesn't want you to know about.

Those things may be innocent, such as debugging hooks, that you'd probably approve of if you knew, but which they don't want made public because then competitors' support people could sabotage the equipment during a support call. Or they could be not so innocent, such as collecting date from your network for commercial use (i.e., selling it to your competitors). Or maybe they don't want you to see the low quality of the code.

But if the source is hidden, there's a reason, and the reason can be summarized as "They don't want you to know about something in there."

If you have any security concerns at all, you should follow the advice that the security folks have been giving for years: Don't run software unless you've compiled it yourself (preferably using a compiler from a different vendor). Otherwise, you have no way of knowing what's hidden inside the binaries.

Of course, in whatever passes for the Real World around here, some vendors are more trustworthy than others. We've had few actual problems like this with open-source vendors, though there have been a few incidents. It's a lot harder for an open-source vendor to get away with such tricks for very long.

But in general, you should be aware that if they don't want you to see the source, there is probably a good reason.

Re:No

[Have Blue]

Or, once you remove your head from RMS's ass, it could be things like trade secrets, techniques which they put a lot of money into developing and don't want to give away for free, the desire to make a living by selling the results of their work, and other relatively benign reasons.

Re:No

[jc42]

Well, maybe, but I think this is overrated. The usual explanation is the fear that their clever software will be stolen and used by competitors. But there have been rather few actual cases of software theft in the history of the computer biz, even when the source was easily available.

The problem is that effective software theft requires porting the software to another platform. I know from long experience how difficult this can be. Writing portable software is difficult; writing hardware-specific software is easy. Software developers have this tendency to take a quick glance at some source, then they usually decide that it's not worth it and they start programming it themselves. I've had several cases where I spent a month or more trying to get some software to work, unsuccessfully despite the cooperation of the software's owners. Then I decided "The hell with it" and spend a day or two rewriting it from scratch. And I'm not the only one; most seasoned programmers will tell you the same thing.

So I conclude that fears of software theft are a red herring. It's a PR claim that has little to do with reality. When people want their source secret, it's almost always for some other reason.

Usually it's embarrassment at the quality of the software. Competitors won't steal the software; they'll publicly ridicule it.

Sometimes it's because of things hidden in the software. That's what you don't want your customers to know about.

Re:No

[Anonymous Coward]

If you have any security concerns at all, you should follow the advice that the security folks have been giving for years: Don't run software unless you've compiled it yourself...

Flog your open-source security fallacies to someone who's stupid enough to believe them. A small, motivated team of security experts reviewing your code is worth more than a legion of morons. Most closed-source efforts can afford a professional review (whether they choose to or not is a different problem), the bulk of the open-source community (with some notable exceptions, both projects and people) have to make due with the legions of morons.

Re:No

[jc42]

A small, motivated team of security experts reviewing your code is worth more than a legion of morons.

The traditional name for this argument is false dichotomy.

You find motivated experts and morons in both the open-source crowd and the closed corporate environment. I could give you lists of all four combinations from personal experience, and I expect that many other people here could, too.

There is historically a separate problem with closed environments, and that's the natural human tendency to react to embarrassing problems with a coverup. This doesn't always happen, but preventing it takes management that is dedicated to preventing it. This doesn't happen often, partly because the dedicated professional types tend to react to coverups by quitting, and this leaves the pro-coverup types in charge. (Google for "Richard Clarke" for a current example. ;-)

This can happen in open projects, too, of course. But it's less likely, because the dissenters can fork off a branch and do it their way. Also, coverups are technically difficult when your code is available for any moron to study.

There is a basic problem that we're talking about groups of humans here. This is a species that often has problems with operations that require more than one participant. Also, we mostly learn from failure. With an open-source project, a failure can be studied and the mistakes can be avoided by others. With secret projects, there's usually no way to learn any lessons from a failure, so you end up making the same mistakes over and over.

Re:No

[ScrewMaster]

What you say is true, but it is also true that much of what they don't want you to look at is how they made it work in the first place. Put it this way, in the modern world hardware is nothing ... it is the software/firmware that truly distinguishes one product from another. If Cisco (or any other vendor) has developed algorithms that make their product superior to their competitors', they have a vested (and justifiable) interest in not making that information public. They would lose their competitive edge, and that would make stockholders unhappy. So, really what we have here is a conflict between the needs of the user to know that what he or she is buying is trustworthy, and the needs of the corporation to protect their R&D investment. This is not an easy situation to resolve: look at Microsoft's "Shared Source" initiative. It's nothing but an attempt to give certain customers the same warm, fuzzy feeling they get from peeking under the hood of true Open Source products like Linux. The only reason that Shared Source exists is because people like the, well, open aspect of Open Source. But Microsoft still keeps it on a short leash.

So, it's easy to say "open up your code so we can feel secure" but it isn't so easy for a company to do that. And really, given that a lot of what Cisco's products do can be done with open source solutions, if trust is an issue look at the alternatives.

Firmware update is dangerous?

[Anonymous Coward]

How long will it be until someone takes the update, compares it a past version of the firmware, and then discovers what the username/password were...

Stating the obvious

[Anita Coney]

No

Reflections on Trusting Trust by Ken Thompson

[Anonymous Coward]

Read it here. It is one of the scariest articles I've ever seen. And yes, I have copies of gcc source dating back to the late 80% that I could use to bootstrap myself back up to the current version without whatever might have been inserted along the way.

The new username/password is...

[OmniGeek]

admin/nopassword ... ??? (just kidding!) Perhaps it's unkind to Cisco to think that if they were so stupid as to do it once, they're stupid enough to do it twice, but one never knows.

Re:The new username/password is...

[user no. 590291]

I suppose. This is assuming that Cisco's motives are truly above board and that this isn't some kind of government assistance. In any case, this will probably help Juniper's sales, assuming they don't get caught at the same thing.

Oh $#17!

[Anonymous Coward]

This is the most idotic thing I have ever heard
of! This is another good reason why admins need
to get applications, servers, and utilities in source
code form, audit the code for garbage like this,
and compile it themselves.

This reminds me...

[fudgefactor7]

...of the phrase that President Regan used to tell Gorbie all the time "Trust, but verify."

Cisco has been a major player for a long time, so we have a de-facto trust relationship with them, but we need to be able to verify their account guarding. All they need to do is open the firmware up and let the million eyes peer through it. Any vulnerability detected and not reported by one will surely be caught by another, and assuming he's not trustworthy either there are still more eyes. Quis custodiet ipsos custodes. The only problem is if the flaw doesn't exist in only flashable firmware (i.e.: in hardware someplace that can't be modified at all)--then that would be an issue. I think we can trust the Cisco hardware, it's the flashed system that needs to be checked.

So, Cisco, how about opening that up? Come on, be a pal....

Surprising, but not that surprising

[allyourbasebelongtou]

This is the most fundamental problem with closed source: even if the underlying code is 100% perfect, bug-free, and wonderfully coded, there is no mechanism to prevent the last developer with sign-off on a project from slipping something nefarious in as code goes into "release" status.

I say this because, IMHO, Cisco's customers generally trust both them as a company and their products. In short, they've done a good job, for a closed source firm, of keeping the perception that they run a tight ship and keep their corporate nose clean.

That said, this is a ding, no doubt, but the bigger question here is while this backdoor was arguably somewhat obscure, it still existed. Even if no one "on the outside" ever learned of its existence, its very existence is troubling.

This is the type of thing that typically would have been caught in no time by the average open-source code-troller (much less a developer) quite quickly.

Sure, Cisco has a decent name, but what about companies that don't have the positive overall goodwill/reputation that Cisco does?

The notion that closed source software is "just as good" or even "more secure" is just plain wack-a-loo. (You can quote me on that.)

Re:Surprising, but not that surprising

[the.WZA]

all your cisco are belong to us

I must be a slow reader..

[Altrag]

I only made it to (Score:3, Funny) before I decided it was likely bogus...

Re:I must be a slow reader..

[strictnein]

yeah yeah yeah... it wasn't marked as that when I read it though... ;-p

wow one more reason to hate cisco

[pbcaston]

One more reason to hate cisco equipment. They may have made an name for themselves in the router business, but they need some help in the ethernet and wireless business. Their switches are garbage for the high price that you pay. You would think that you are getting alot for the money you pay but what you'll is find that you have to buy more just to get same features that are in the 3com and netgear switches at much lower prices. They act like they can write thier own standards and not comform to others. They are the M$ of networking, and this just proves it. I sure the same can be said about Windows *

Re:Answer

[Anonymous Coward]

A: Because it ruins the flow of conversation.

Q: Why is top quoting retarded?

Anyone know what happened to force this revelation

[uiil]

I doubt a newfound sense of benevolence initiated this admission.

Something they couldn't buy off or threaten into silence most likely.

not a conspiracy

[oogoody]

Backdoors are very common in embedded devices
so you can bootstrap the system. They should
have covered this better, but it is probably
not an evil conspiracy. It's probably just
developers and testers trying to do their
job without a lot of security shit that
makes everything take longer and be more
difficult.

Re:not a conspiracy

[Anonymous Coward]

your annoying habit
of line-
breaking in weird
places is really annoying. please
don't do that any
more in the fut
ure.

/.-ers just don't get it....

[egriebel]

I'm going to go out on a limb and predict tons of posts of "dump cisco now!!" here. It'll never happen, Cisco will shrug this off. There's no way that the corporate infrastructure is going to be torn up, Cisco has too much penetration and momentum. Acutally, I bet it won't even hit mainstream media and be barely a footnote in NetworkWorld and related trade rags.

There will be no wholesale move off of Cisco products. Why?

1. Who else are you going to use?
2. Who is going to pay for the new hardware?
3. When are you going to do the upgrading?

Let's roleplay the conversation between the CIO and CEO/COO:

CTO: Hey boss, I need $x million to replace all our Cisco equipment NOW!
CEO: Hmm, that's a lot of work and money, are they broken?
CTO: Well, no, but there's an extremely serious vulnerability!
CEO: <blinks>
CTO: Every Cisco box has the same administrative password!
CEO: <starts to watch the window washers and birds outside>
CTO: Anyone can log in to our systems with this password
CEO: Hmm, I see....Is that bad?
CTO: Yes, which is why they need to be replaced.
CEO: Well, it certainly sounds serious. Why don't you prepare a proposal, get buyin with the Regional VPs and Directors, run it by Frank in operations, and then talk to my assistant Tiffany and get some time on my schedule.
CTO: Sir, I think it should be expedited.
CEO: Yes, hmm. So have you heard how Tiger is doing at the Masters today?

The bottom line is, most CIO/CTO's of non-IT companies could give a flying f**k what runs their networks as long as it works, stays up most of the time, is not too expensive, and is recommended.

Re:/.-ers just don't get it....

[Linker3000]

Tell the CIO/CTO it may allow outsiders to see their Pr0n stash and things might speed up.

Re:/.-ers just don't get it....

[Anonymous Coward]

You left out an important part of the exchange:

CTO: Sir, I think it should be expedited. ...

CEO: is there a cheaper way to fix this
CTO: er, yes. Cisco has offered a free fix that solves the problem.

Now which response is more likely:

1) CEO: Yes, hmm. So have you heard how Tiger is doing at the Masters today?

or

2) CEO: why are you wasting my time instead of implementing the fix?

Re:Cisco is not alone. It's industry wide practice

[Anonymous Coward]

No no, they put a modem on the rs232 analyzer that's in their modem port. You "do the magic" they send the recorded bits off to alt.hack.yerEmployersAboutToDie and viola. In a few months you're lining up with all your former coworkers at the local unemployment shop while management sorts out the cords on their golden parachutes. bk425

be glad

[bendsley]

hell, be glad at least that cisco even mentioned it.

Yes but...

[Chris Pimlott]

BSD licensing lets venders modify it without releasing the source of their version. So what's to stop FooNetCo. adding a backdoor to their version of OpenBSD and shipping that?

Re:Yes but...

[markan18]

Don't buy foonetco's router with openbsd inside, get a high end pc and install openbsd yourself. You got yourself a decent router with no backdoors in it.

The only downside is it may not support all routing protocols used on the internet or large entreprise networks.

Re:Yes but...

[possible]

BSD licensing lets venders modify it without releasing the source of their version. So what's to stop FooNetCo. adding a backdoor to their version of OpenBSD and shipping that?

Nothing. But if someone really wants to look, they can analyze the binaries and find out. What's to stop FooNetCo. from adding a backdoor to their version of Linux and then releasing doctored source code? The same thing.

Re:Yes but...

[Chris Pimlott]

What's to stop FooNetCo. from adding a backdoor to their version of Linux and then releasing doctored source code? The same thing.

There's one important difference; if they don't release the actual code used, they're breaking the law. With BSD, the hidden backdoor is completely legal.

With software the problem is worse

[Cardbox]

We let our users password-protect their databases. So of course they lose the passwords and we have to have a mechanism (challenge-response) to let them break in and reset the master password.
The problem is, how do we know the person asking for this service is the owner of the data? There's no way (that I can see) of both guaranteeing that a thief won't ask to have his password broken into and that a legitimate owner won't be prevented from rescuing his own data.

Re:With software the problem is worse

[technos]

Use the annoyance factor.

If someone calls and asks for a password reset, tell them to get stuffed. If it actually needs to be done, you'll get a call from a lead tech or CIO or such. Ask for his name, phone number, and the name of his supervisor before you tell him to get stuffed. Then go into your little customer database, call the guy you sold the hosting to in the first place, ask them to call the lead tech, hand over the info you have on him, and confirm he needs the password reset, etc.

If it's a social engineer, it'll prolly never make it past the first call. Morons that can find the password out on their own are also screened by this call.

The persevering social engineer will also try call #2. But your call back in step #3 to someone not normally involved in a password reset (The purchasing manager, CIO, whomever it was signed on the dotted line for the equipment/service is likely not involved in maintaining it.) will screen all but the worst kind of pasword attempts.

Re:Cisco is not alone. It's industry wide practice

[John Starks]

Yeah, they're really happy until the backdoor username and password leaks and their network is hacked.

There is no justification for this. If I bought ANY program with a backdoor that I could not disable, I would be outraged. What's the point of any security if an immoral employee can break right through it? Or more importantly, if my competetors/hackers/the government can break right through it after bribing said immoral employee.

Ridiculous.

That's amazing!

[mcmonkey]

I've got the same combination on my luggage.

Cisco is definitely doing questionable things

[Anonymous Coward]

I have a high-up friend at a company that designs and makes chips that are used to provide GPS data for newer cell phones, for the e911 federal requirements in the USA.

Apparently his company was approached by Cisco, on the feasability of using their GPS chips in "all of our [Cisco's] upcoming products." From the discussions, it appeared that Cisco wanted to put GPS capabilities in their routers and such, but they were being hush-hush about it, implying that this wasn't to be a publicly known feature.

And before you say "You can't use GPS in a data center", I should note that at least one company in that field has a chipset which is known to work well inside of buildings. And ethernet cables make huge antennas.

Re:Cisco is definitely doing questionable things

[user no. 590291]

So while we're buying stock in companies positioned to make a national ID, buying a few shares of Garmin wouldn't be a bad bet either, it appears.

Re:Cisco is definitely doing questionable things

[Farmboy]

Actually my guess is that they would like to make their devices location aware. You can do some interesting things once a access point knows where it is and whose its neighbors are.

I believe the military created this technology and Motorola licensed it and is using it in their Canopy product.
(I think, I am not 100% sure though, can't remember where I read that)

You can throw up AP's on the same frequency without worrying about cancelation of the signal.
http://motorola.canopywireless.com/

If you have the $ and want to light up an entire town this is the way to go.
Anyways, it would be interesting to see this incorporated in a WAN.

Re:Cisco is definitely doing questionable things

[user no. 590291]

That, and it'd then be easy to make them obey government restrictions for the country they happen to be in (e.g. China). This isnt' far-fetched given Cisco's prodigious technical assistance in helping the PRC firewall its citizens. Too bad Cisco couldn't have null-routed port 25 to the Western world while they were at it.

Re:Cisco is definitely doing questionable things

[MadHungarian1917]

Cisco also makes a product called the 3200 Mobile router. Which they sell to the Police, Military, Delivery and Field service companies

It uses both celluar and WiFi technologies so that vehicles are always networked in some fashion and for these customers GPS probably would be a big win.

Re:Cisco is definitely doing questionable things

[0x0d0a]

It's also very useful for policing if all you have to do when you want to track someone down is traceroute to them, use the government backdoor to ask the AP where it is, and send a squad over.

Huge difference..

[Allen Zadr]

Efficient routers tell you what the feature is, what the impact is, and there is a physical method by which to defeat the vulnerability (lock the door).

On the other hand, Cisco's backdoor can be accessed remotely and wirelessly. So physical security will not help.

Re:Huge difference..

[pyite]

Any Cisco admin worth their salt is going to ACL off their management interfaces limiting the number of hosts that can actually telnet/ssh to the box. All hosts that have access to the management interface also should have good security. If your network is designed well, releasing enable passwords for even a very important device (while critical) should not pose any actual threat.

Re:Huge difference..

[SpaceLifeForm]

Does not sound secure at all to me.

Telnet should *not* be used at all, and ACL-ing by ip is worthless if the environment can be arp poisoned.

Re:Huge difference..

[pyite]

Ehh... not as easy as it sounds. Suppose your management interface is Vlan 1. Let's assume you have a physical switchport somewhere on Vlan 1. Grabbing a random IP on Vlan 1 won't work if it's restricted, so you need to poison. Spanning tree (you are running spanning tree, right?) is in listening mode. It's going to go into blocking soon. To get around that, you have to send a BPDU out, win the election and become root. I will concede that that is doable. However, you shouldn't have random switchports laying around in no shut or enable on Vlan 1. In addition, ports should have trunking turned off. The other option is spoofing your IP to be one from a trusted network. You should be running antispoofing ACLs inbound on all your interfaces, so this shouldn't be a problem either.

All Cisco Products have backdoors

[Bruha]

Routers and switches can simply be switched off and then hacked as they boot up. This has been around for a long time.

However I am surprised to see it like this for a WLAN product becuase now someone can sit in the parking lot and hack theirselves into your companies bandwidth.

Ah! Found the problem.

[kitzilla]

Well, it's no wonder Cisco's software sucks:

The Cisco Kid was a friend of mine / The Cisco Kid was a friend of mine / He drink whiskey, Poncho drink the wine...

A quick twelve-step program and Cisco should be all set to take Microsoft's lead and usher us into the age of Trusted Computing.

Might not have been policy

[PhilipPeake]

It seems unlikely to me that Cisco would install this username/password as a matter of corporate policy just to allow them a backdoor to get into a device that a customer had screwed up.

Its much more likely that this was installed by an employee who thought it was a good idea (for any one of a thousand reasons), or by a product manager who similarly thought it a good idea.

Whatever the reason, I suspect that whoever did this will have poor career prospects with Cisco.

Re:Might not have been policy

[0x0d0a]

Or it's standard practice on Cisco devices and the password or algorithm used to get into this particular one leaked.

If it isn't standard practice, it'd be easy for Cisco to put out a press release saying that they don't have backdoor passwords on any of their other products.

Re:Cisco is not alone. It's industry wide practice

[Anonymous Coward]

As long as the backdoor only works when you go through a certain channel (diagnostic port) that normal traffic can't use, then I don't see a problem with this.

(Disclaimer: I have no idea what a diagnostic port is.)

Negligence

[Animats]

Why aren't we hearing words like "knowingly, willfully negligent", or "reckless endangerment", or "conspiracy to violate the Computer Fraud and Abuse Act"?

A Cisco exec should do hard time for this.

Re:Negligence

[Anonymous Coward]

or maybe the person who commited the backdoor to CVS

Why not put a "Master Password Reset" button

[Anonymous Coward]

on the device (that only resets the master password not the entire config) or let it load the password from a PCMCIA or similar device?
For devices like switches this should work just fine since most of them have physical security.

Re:Why not put a "Master Password Reset" button

[thpdg]

We do have a PCMCIA system setup, but we found out early on that when users opened the machine in an industrial environment, it was exposed to debris, mess and electrical noise that caused extreme problems. For most customers, we do recommend this method when the oppurtinity arises.
Want a job?

No!

[vlad_petric]

It's 12345.

DAMN! I just gave away my password.

HEY!!

[Anonymous Coward]

That's my luggage combination!!

Thats why you buy from Snapgear!

[Anonymous Coward]

Snapgear!

Open-source, uClinux based routers, VPN solutions and OEM products!

2 key system

[Mes]

We use a two key system for our backdoors. If the user needs a support engineer to log in and undo the damage, they have to create the account themselves. Only then do we have access to the backdoor. Once we're done, the user can delete the account.

Re:2 key system

[Pahroza]

That doesn't really sound like a back door, but more like opening the front door for you to come in and help out.

What's the frequency, Kenneth?

[Rick the Red]

Assuming the word has gotten out somehow

Assuming it has, what is it? What's the backdoor user ID and password?

Seriously, why should only the criminals know this stuff? Why can't the rest of us know it, too?

Re:What's the frequency, Kenneth?

[jrockway]

Yeah, I want to know it too. I'm tired of all the blocked ports at my school :)

"Can we trust closed-source vendors?" NO!

[Futurepower(R)]

From the Slashdot story: "Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?"

This should be shortened to: "Can we trust closed-source vendors?"

History has shown that we cannot.

Take Microsoft for example. LUGOD maintains a list of stories about Microsoft abusiveness: Reasons to Avoid Microsoft. I counted more than 200 in 2002, and things have gotten worse since then.

(This seems to be one of the few times that Open Source advocates have invented an interesting name: Linux User GOD. Sounds like a new religion.)

Part of the problem seems to be that, eventually, closed-source vendors begin to be controlled by managers who have no technical experience. Such managers can help the company make more money only by abusing the customer, because they don't know enough to contribute to technical improvements.

Why has Google risen to prominence so quickly? Partly because they know what they are doing technically. But largely because they have a policy of "do no harm". It's a simple policy, but most managers are not able to come to the conclusion they should follow it.

Most managers seem to have received their training by mimicing the abusive, ignorant PHB in Dilbert cartoons. Think what a terrible world we live in that Dilbert is considered funny!

I know most Open Source developers are uncomfortable with this description, but they approach their work as an act of love. Whatever the reason, history has shown that they are far more trustworthy.

Re:"Can we trust closed-source vendors?" NO!

[Anonymous Coward]

> history has shown that they
> are far more trustworthy.

With that you effectively demonize any person who works for a company that is not open source based. I work at a place that does 50% military work - closed source by definition I suppose. Everybody I know there tries hard to make a good product. We perform code reviews and quality control and do the best we can to provide a product that is what the customer wants and has paid for. Your black-and-white strokes aren't very fair to your fellow humans who don't happen to work in an environment of which you approve.

w

Re:"Can we trust closed-source vendors?" NO!

[0x0d0a]

I work at a place that does 50% military work - closed source by definition I suppose.

I'll bet you that the military uses SELinux.

Re:"Can we trust closed-source vendors?" NO!

[peacefinder]

From the Slashdot story: "Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?"

This should be shortened to: "Can we trust closed-source vendors?"

I can shorten it still further:

Can we trust?

The answer, of course, is that at some level we have to. We trust unreliable people with our lives every time we run a green light. It is important to remember that "choosing to trust" is not the same thing as "ensuring we won't get burned".

Not to say that it's unreasonable to withdraw trust from a closed-source vendor who has behaved badly; it could be a good choice. But to function at all, at some level we must choose to trust in another's competence and goodwill. That's just the way the world works.

(As for my network, though, I put my trust in OpenBSD.)

In the immortal words of William Shakespeare...

[Zenmonkeycat]

...WTF?

You mean that Cisco is so retarded that they put in a default superuser that can't be changed or disabled? I hope this it's a different password for each box, else I'm never touching anything made by Cisco again.

Any company stupid enough (and I don't use the term stupid lightly) to think that 1) a backdoor is not simply a good idea, but so neccessary that it should never be disabled and 2) that information like the username and password wouldn't get out, doesn't deserve to manufacture products that other people buy.

Next time I'm asked for my recommendations on routers for corporate sites, I'll bring in an old PC with a couple of NICs and Linux, and show them how a /truly/ secure system works.

Re:In the immortal words of William Shakespeare...

[Anonymous Coward]

you are the most brilliant person ever. Why didn't *you* invent all this stuff and become a millionaire? Oh, right.

Want Another one...

[Ursius]

Hmm... Should I blow the whistle. Let's look at Cisco's 15454 gear, arguably some of the most widely deployed gear for SONET communications. Yes, 30+ Thousand boxes flittered all around the globe. Want to know a read/write user/password that is also hardcoded? I'll take donations... Do I have takers?

Re:Want Another one...

[0x0d0a]

See if 3com or Lucent want to put up some money. :-)

Re:Cisco is not alone. It's industry wide practice

[Strider-BG]

Why? Do you think people should have to throw away multi-thousand dollar boxes because someone lost the password?

Physical security goes hand-in-hand with infosec. There's a reason that physical security is part of the CISSP. If you can get physical access to any system you can get in . Having a "back door" that's only accessible when physically connected to the system is a common mechanism (now and for the foreseeable future) of performing password recovery.

Chris - CISSP, CCNP, RCIE/RCSI, MCSE, CNE

Solution: Change the admin password!

[quakeroatz]

This isn't a let down for Cisco or a boost for open source. It's a common thing for any system to have a default account, root (linux) Administrator (Windows) admin (routers/switches/etc), just change the password!

Anyone who operates any multiuser device and doesn't read the manual, and that first page that tells you to change the default password, deserves to be hacked, prodded and slapped around the face, neck and buttocks.

Re:Solution: Change the admin password!

[Anonymous Coward]

you didn't even come close to RTFA, did you

Re:Solution: Change the admin password!

[Anonymous Coward]

RTFA again! Hell, I'm not even going to explain..

Re:Solution: Change the admin password!

[0x0d0a]

Default password: Changeable password that comes set on a vanilla machine. Owner knows of the existence of this password, and can easily close it as a hole by changing the password.

Backdoor password: Non-owner-changeable password that comes hidden on a machine. Owner does not know that this password exists, and cannot prevent people who know about it from exploiting it.

This article is about backdoor passwords.

So do you even know what a WLSE is?

[Anonymous Coward]

Find out here Its not the router Its not the radio Its not the switch Its the management platform that you can use to monitor your wireless connections. Why any company would allow network access to this device from a un-secure network is beyond me. Still don't know why its frontpage news, besides the fact it gives us a chance to bash closed source systems.

Re:So do you even know what a WLSE is?

[0x0d0a]

I dunno whether it's really much better to have your NOC infrastructure rooted than a switch somewhere.

Re:you ungrateful motherfuckers

[nate1138]

Cisco is bad because it doesn't sell open source solutions?

No, Cisco is bad because they stuck a backdoor into their product that potentially fucked over a bunch of their customers.

I bet half your jobs depend on cisco.

And what kind of half-assed argument is that? Just because people use their products doesn't mean that their jobs depend on Cisco. Cisco can be ripped out and replaced just like most vendors. Get some Foundry or Nortel equipment.

Oh yeah, and fuck you too.

Re:Answer

[Anonymous Coward]

lol

Username and password

[Anonymous Coward]

Username: debug
Password: synnet

Not open/closed source, just incredible stupid

[pcause]

This isn't an open / closed source issue. This is simply sheer negligence and stupidity on Cisso's part. It is hard to believe that ANYONE in this day and age would leave back doors in shipping code. What is worse is the statement that the back door can not be disabled. This borders on criminal stupidity. This is a complete lapse in management and development oversight.

Most F500 comapnies have language in all agreements that make the vendor attest that there are no back doors in any product. Cisco is going to have to fix this, and likely bear whatever cost is related, including replacing units. And their liability for any secruity breaches and losses that are a result will be large. Since someone has already posted a "how to" to exploit this, we can expect that people will.

Just amazing. My faith in Cisco is greatly rediced. They need to explain to the community how this happend, whether or not there are other products that have this issue and what they are doing to make sure it doesn't happen again.

Re:Not open/closed source, just incredible stupid

[Anonymous Coward]

and why aren't you out there shipping a better product?? Oh, right.

http://www.acm.org/classics/sep95/

[Puzzleer]

The obligatory reference to:

Reflections on Trusting Trust
by Ken Thompson

http://www.acm.org/classics/sep95/

Re:http://www.acm.org/classics/sep95/

[Anonymous Coward]

Ken also says Linux is nothing more than an ancient operating system and Windows is innovation..

Re:Cisco is not alone. It's industry wide practice

[Anonymous Coward]

:level 3 tech casts silver modem at level 2 bug.

:level 2 bug takes damage.

No sweat

[Allen Zadr]

I agree - for the sake of top down reading it's best that the correction be admitted to in the topmost post (which I've done).

I had stupid fast typing, so the correction is important.

Don't sweat it - I don't even use the 'enemy' setting.

bacdoors

[imnoteddy]

Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?

You can't trust open source either.

Remember the CISO TV ads?

[Anonymous Coward]

Yeah, the ones where hackers end up in jail (where CISO employees should now be)? And the corporations win? Those so pissed me off. I think CISCO deserves what it is now getting for being so bloody arrogant.

NSAKEY

[Anonymous Coward]

http://www.itsecurity.com/dictionary/nsakey.htm

Cisco responsiveness

[Beryllium Sphere(tm)]

>I highly doubt that they will be embarassed enough to have learned a powerful life-lesson.

I admit this is anecdotal.

A penetration tester at a local consultancy spotted a Cisco vulnerability and reported it.

He got an acknowledgement from a human and a thank-you when the fix shipped a little while later.

Cisco's a big enough company to act inconsistently, but they've certainly been known to do the right thing.

No sftp?? was(Re:No Refund - firmware fix)

[justMichael]

Are you sure there is no sftp?

sftp is an interactive file transfer program, similar to ftp(1), which
performs all operations over an encrypted ssh(1) transport. It may also
use many features of ssh, such as public key authentication and compres-
sion. sftp connects and logs into the specified host, then enters an in-
teractive command mode.

But we knew what you meant ;)

Re:Cisco is not alone. It's industry wide practice

[ThisIsFred]

So, yes, it is a security hole, but it is also something that customers are happy about when they need it.

That's great, and I'm sure your customers appreciate it. But does it have to be 1) undocumented, and 2) on all the time without the option to be disabled? No, it doesn't. The customer should at least have to flip a switch to activate it. But because it doesn't work that way, ol' Fred has to always be looking over his shoulder and running his packet sniffers 24x7 because some manufacturer may have decided to include a major, trivially exploitable security hole on his hardware.

I don't buy the "that's the way the industry does it excuse." Obviously (judging from some of the other posters here) there is a better way to do it. There will always be a better way to do it.

Re:Cisco is not alone. It's industry wide practice

[forgetmenot]

I'm assuming you're talking about PLCs and SCADA systems - which are typically custom designed for the job/client. There's a big difference between that and the backdoors in those kinds of systems that apparently your customer knew about, and this Cisco bulletin. This is much larger in scale with a large well-known company and a large staff (potential spilly-talkers) and affects perhaps thousands of customers who did not know they had backdoors. Consequently the security implications are much more severe. If I have access to the custom built PLC in , say, a sewer pumping station - whoopdeedoo.. sure I can cause damage but my ability to cause damage is likely limited to that particular system and the information is probably damned hard to come by (I would hope). Plus I thinks it's safe to say I'd be a lot easier to catch since there's probably only a very limited hand full of people who ever had access to it in the first place.

This isn't surprising

[Prong]

They've had previous instances of this, in both the Cisco designed products and in stuff from vendors they bought. I was rather horrified to find out that there was a backdoor password into one of my customer's ATM switches (a large bank), and I wouldn't have discovered the fact except the support technician at Cisco was in a hurry to close the ticket I had open. (The customer had rightly changed the enable password, and I couldn't track down the guy who had the new pw).

Re:Cisco is not alone. It's industry wide practice

[gilesjuk]

Erm, reset button? that requires physical access to the hardware. Having highly important network hardware with a backdoor is risky these days. You'd be better supplying password recovery software which operates on the console port.

Just saved us from spending $30K

[Nonesuch]

Our Cisco sales rep had just about convinced management that the enterprise would be more secure deploying WLSE (List price: $9K) than if we just continued the current policy of "No WiFi no way no how".

The logic was that having no wireless network at all is less secure than deploying a Cisco wireless network with the Wireless LAN Solution Engine, with the enhanced logging features and ability to monitor RF and detect rogue APs and the like.

Now that "Capital Requisition" (WLSE, APs, antennas) is headed for the circular file...

Re:Just saved us from spending $30K

[Anonymous Coward]

Way to kneejerk... Bravo.

Re:Just saved us from spending $30K

[0x0d0a]

The logic was that having no wireless network at all is less secure than deploying a Cisco wireless network with the Wireless LAN Solution Engine, with the enhanced logging features and ability to monitor RF and detect rogue APs and the like.

That is the *stupidest* fucking idea I've ever heard of (granted, it's from a sales guy with little incentive to be honest, but still). If someone's *that* worried about rogue APs, why not have alarms start shrieking when a wireless MAC appears on your network? Why not use one of those dumb devices that just detects the presence of WAPs?

Wireless (at least in its current form) is a simply awful idea from a security standpoint. I've never been able to figure out how vendors manage to sell it to companies.

Re:Just saved us from spending $30K

[Nonesuch]

Wireless (at least in its current form) is a simply awful idea from a security standpoint. I've never been able to figure out how vendors manage to sell it to companies.

Well, one vendor's "good wireless is better than no wireless" sales pitch almost worked!

I've had a lot of requests come in for wireless, always from middle management, local site "IT Directors" who read about WiFi in a magazine, just got a super lightweight Centrino notebook, and figure that their new $4K notebook came with wireless, so they might as well get some use out of it.

So far I have been more successful at stemming the tide by pushing the drawbacks regarding reliability and performance and scalability than just simply pounding the security drum.

I always think about....

[zogger]

... microsoft and that joke fine they got, where they could print their own money-vouchers.

Uh huh, they were "punished"

I got me a WHOLE ROLL that says reynolds on it, and I tell ya, MS cut a deal with the feds/spooks, there's back doors to the back doors in their stuff, and will be, for many moons...

bet a voucher on it...

replace your CISCO router with a linux box!

[johnnnyboy]

After so many firmware upgrades and security holes. I decided to rid our company of cisco routers altogether and replaced them with linux boxes. So far it's handling our 100 Megabyte pipe with no problems. Our company peaks as 40 Megs per second everyday. I've been really impressed with my linux box.
Is there anyone else who has done the same?

Yeah.

[Anonymous Coward]

When I first read that I was like totally blown away. Today, I have root on 37 PCs.

Re:Cisco is not alone. It's industry wide practice

[Anonymous Coward]

..you do realise that when you're doing this service to them, they are already basically giving you access to the device by hooking up the modem to the diagnostic port?

that is QUITE different from what cisco was caught doing now. If you could have just telnetted to the boxes from your home through your normal internet connection, and there would have been backdoors to make that possible, THEN you would have been getting near to the seriousness of what's going on now.

Cisco Products Have Backdoors

[Crazy like a fox]

Disclaimer 1: I work for Cisco, though not on the product in question.

Disclaimer 2: Any opinions expressed here are mine. I don't speak for Cisco. You knew that already, right?

I find the thesis of the original article somewhat dubious. We jump from "here's a security advisory" to "Can we really trust closed-source vendors?". Yes, with open source you have the ability to scrutinize the code to search for security holes and other problems. However, do you actually scrutinize every piece of code you download? Do you never download any prebuilt binaries from anywhere -- images that could easily contain suspect modifications that you might not know about, even if you did scrutinize the source you think those binaries are built from? In short, I find the presumption of safety when dealing with open source somewhat unwarranted. Don't get me wrong; I like open source. My own computers are all Linux-driven boxes. But I didn't examine all the sources, nor compile the entire system and every application set from scratch. I doubt most of us have.

Reading some of the replies already made on this thread, I notice that many seem to assume intent, even malice, on Cisco's part. I seriously doubt either is the case. Some other possibilities:

• Some early testing code which someone forgot to remove.
• Something we inherited from an outside party, and failed to catch.

and of course, the obvious possibility of simple stupidity (some would probably argue that the above two points fall into the 'stupidity' category too). Regardless of the cause, I think it is probably more likely an error on some individual's part rather than an intentional action of any group, much less the company as a whole.

I have no more knowledge about the real source of this particular gaffe than any of the other readers here. Still, I know the products I work on, and that none of the developers I know of would ever try slipping a back-door into code, or even intentionally let any security hole into the code. Indeed, we take security issues seriously and try to fix any problems we know of as fast as possible. Consider that we have stock and stock options. We want our company to do really well, and make us all fat happy campers. Gaffes like this are just plain bad business. ;-)

<subliminal>Buy Cisco! </subliminal> (sorry, couldn't resist)

Re:Cisco Products Have Backdoors

[smeenz]

*exactly*.

At least someone's posting a sane response to this.. even if you do work for Cisco.

Re:Cisco Products Have Backdoors

[rob_kg]

Hmm.. ofcourse not everyone will check all source code.. but someone will see what someone else did.

And the very hard to find vulnerabilities might not be spotted by the next person to read the code, but is very likely to be found eventually..
As for a backdoor like this, it looks very unlikely that anyone having access to the code and reading that code would not have catched the backdoor.

And I don't think anyone sees this as "just another advisory" for _obvious_ reasons.

I don't believe cisco did this intentionally, but some employee must have.. even if his intentions were to remove it afterward, to me i think it's quite risky if you do something like that. It also makes you wonder how well that code gets checked before release. So, people concerned with security are naturally going to think about what this means.. basically there are legitimate reasons for FUD here :). Especially now that this is known, if it was opensource everyone would be interested in seeing other code of Cisco products..

Still I think everyone can make a mistake, and even a big mistake, so it's a personal issue if you still trust Cisco products or closed source in general. And on the other hand, if you believe that Cisco or some other closed-source vendor has good intentions and that this was not deliberate, does this also mean you should trust it's products? It was a mistake right, and it was a big mistake, we can only guess what a company like Cisco tries to prevent this from happening. As for Open Source this still holds true ofcourse, but with less inpact. An open-source software writer might not do any security checking at all.. but those reading the source code quickly report bugs.. if there are many too-stupid-to-be-true bugs found (Matt's scripts ;-)), we know what kind of programmer we're dealing with.

In other words; this was a post of FUD, but I think it's based on legitimate concerns. Is there a way for us to know to which lengths closed source companies truly go to keep their code clean? There surely is no way _we_ can verify their code is clean...

Errata ad infinitum

[kfg]

Idiotic and wholly unintentional double negative in the first sentence giving the whole thing the reverse of its intended meaning. That's what happens when I post out of the corner of one eye when my attention is really on the book I'm reading.

"Four Wings and A Prayer." Nice little popular work on Monarch butterfly migration. Written by a woman who lives just up the road from me apiece. I give it a hearty recommendation for anyone who might be vaguely interested in such things.

KFG

Re:Errata ad infinitum

[feidaykin]

"Four Wings and A Prayer." Nice little popular work on Monarch butterfly migration.

Silly KFG, there'd be like, what, ten people here that care? Heh... Actually, I did get away from the computer yesterday, on a bicycle even! However I only biked a paltry five miles or so, through a marsh trail here in Wisconsin. Some interesting creatures in that marsh, but mostly humans and humans with dogs on the trail. I saw no butterflies... still too cold? There were a few ducks. Quack, quack. I really should bike more often, but hey, isn't Wisconsin the fattest state in the US? So compared to my brethren here, I'm doing great! And compared to KFG, I didn't bike at all. Oh well...

Re:Errata ad infinitum

[Anonymous Coward]

The other stalker here.

Great job on the parody of KFG. I got a kick out of it.

Fine them!

[rob_kg]

This is so terrribly bad.

I've read some comments on the issues, some try to make a lame excuse to make this acceptable but this one is really terrible:

can be used for customer support
-> Bull, there are more secure ways to do that, and if so why don't we know about it and can't enable/disable this?

There is absolutely no excuse for this type of thing. Now there has been a discussion whether vendors should be fined for their bugs.. well in this case they should! This is equal to acts of computercrime!

Now.. it wouldn't be fair to fine companies for an undeliberate bug, but this case is so obvious that it's a crime.
Even if this was some act of a malicious programmer, then I think Cisco is responsible for finding out who did it and bring him to trial!

Re:Fine them!

[Anonymous Coward]

I think they should burn him/her too. You'd like that, right?

Re:Fine them!

[rob_kg]

Where the hell do you come from ?

Re:Fine them!

[Anonymous Coward]

same as you -- overreactionary fringe element.

In other news...

[drgonzo59]

The Pope is Polish and bears crap in the woods.

* they put a modem on the diagnostic port *

[Anonymous Coward]

Clearly exactly the same situation as this huh ...

Why I can Sleep at Night

[IceAgeComing]

The following belief enables me to sleep at night:

There are many eyeballs at work at each level of hardware and software because large hardware/software projects are necessarily collaborative efforts.

Keeping malicious secrets in projects involving lots of people would require serious coercive control that most people naturally find repugnant.

It only takes one super-paranoid out of a million end-users to uncover a strange login attempt via some unconventional means. Then it becomes known to everyone. The risk for getting caught is very high, IMHO.

I can't believe that ALL router vendors ALL AROUND THE WORLD, for example, would conspire to hack their hardware in exactly the same way. So if someone wanted to be super-paranoid, they would buy some random kind of external packet auditing system and apply it to an arbitrarily chosen hardware/software configuration.

Backdoors are here to stay.

[LostCluster]

Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?

Well, we certainly can't trust Cisco anymore. The reason is because trust is built up by having the ability to screw up and then not doing so. Cisco has clearly violated the trust of anybody who wanted a zero-backdoor product, and I submit that this breach is one that cannot be recovered from.

However, I certainly understand why Cisco insists on there being such a hard-coded full-control backdoor. If you ever lose possession of the root password, you are screwed and you can turn a big-dollarsign router into a paperweight. It makes sense that Cisco should be able to swap your locked-up router for a like part in its default settings, and then be able to recover most of its value as an "open box" "remanufactured" item since there was nothing wrong with it other than an unknown password that since has been reset.

Really, I'm not mad at Cisco for having backdoors as much as the fact that they refused to admit that there were secret backdoors.

Re:Backdoors are here to stay.

[borgheron]

There is always the possibility of blanking the device's ROM and starting over instead if just letting it remain dead. Yes, this might require someone from CISCO to come to the site, so what?

This is one of the reasons why closed source manufacturers scare me. They can put whatever they want into the product and you're left to their mercy.

GJC

Re:Backdoors are here to stay.

[OldMiner]

Oracle is closed source. But, let's say they went open. I'm told they have somewhere around 2 million lines of code in their database server alone. And you can vet 2 million lines of code for something suspicious? What if it's a buffer overflow which can only be triggered under specific conditions? How do you detect built-in security holes in gigabytes of executable when the accidental ones still slip by?

Your argument is the same old tired /. speak, and it's old and tired.

Re:Backdoors are here to stay.

[borgheron]

OldMiner,

And keeping it proprietary so that only a limited number of people can look at it helps how?

More eyes is better. And I never said I could vet out 2 million lines of code. I said that at least having the *option* to vet the code if I wanted to makes me feel better.

Also, if the thing were open source, do you think that they would have added such an obvious hole? No. Software will *always* have bugs, it's part of the business. I never claimed Open Source as a panacea. Only as a deterrent from backdooring your clients. :)

Your talk is the same trashtalk I expect from people who don't see the point. I'm not spouting rhetoric here.

GJC

Re:Backdoors are here to stay.

[OldMiner]

Open source software is great, isn't it? It makes one hide his chicanery better. There's a wonderful old bit about the dangers of trusting trust. Perhaps you've read it?

There's always a limited number of people who can read code. It's limited by those who know the language. Those who are interested in the code. Those who have the time. Oracle was given as a case of an extreme example. They could hide massive amounts of things in relatively plain view in such a large source. Because, even with many eyes, the scope would be too large. But, how many eyes would be qualified and capable to understand all of that code? How many eyes would be drawn to the firmware of a router which has a strange function name which happens to be parsed in weird ways during the authentication procedure?

You're spouting rhetoric here.

Re:Backdoors are here to stay.

[Anonymous Coward]

that's like saying you're at the mercy of the newfangled computers in cars these days. You can always buy a 1960's Ford.

You're only at someone's mercy if you put them in that position.

If closed source scares you, then you've got a rude awakening once you open your eyes to the rest of the world (outside of computers)

Re:Backdoors are here to stay.

[Anonymous Coward]

Really, I'm not mad at Cisco for having backdoors as much as the fact that they refused to admit that there were secret backdoors.

But if they admitted that there were backdoors, then those backdoors wouldn't be secret anymore, now would they?

Re:Backdoors are here to stay.

[borgheron]

Again, for the dense (this means you)... How is proprietary better when even those who can, or would read the code can't?

BTW, I did read Ken Thompson's article. I don't agree though, that it's better to keep something closed to make it "more secure". That's just fucking stupid.

GJC

No Big Deal.....

[realperseus]

All the major telecommunications manufacturers have _backdoors_ into their systems. Avaya, Nortel, Lucent (ok... Avaya again). Point is, they all have them in there to provide technical support. For instance, with Avaya their tech calls Denver, enters your Sold To number, and voila, he logs onto your PBX. The passwords provided are dependent on time of day so if you try and use it later you can't get on. Lucent has factory passcodes for their old ClearTrac series of routers. Nortel has them too but I am not familiar with their process of obtaining their maintenance passcode. I consider this no big deal... *yawn

Re:No Big Deal.....

[Anonymous Coward]

thanks for weighing in... we're all so relieved you're yawning. you just wouldn't know.

Can't you people READ THE F**KING ARTICLE ?

[smeenz]

Honestly... you people can't resit jumping to conclusions can you ? If you READ the f'ing article, you would see that this vulnerability exists in a Cisco *application* that runs on a *linux* platform that is used to *manage* their wireless aironet devices in bulk, and has NOTHING to do with their switching/routing/wireless hardware products whatsoever.

If you read further, you would note that Cisco has already released patches for the problem.

If you had ANY experience with cisco security vulnerabilty disclosures, you would realise that cisco's definition of "workaround" means "a way to avoid the problem without applying patches or updates", because many cisco customers aren't able to apply patches the second an exploit is announced due to down time / planning / change control measures.

Just because it says there is no workaround, it doesn't mean there isn't a fix. And there is, in this case, which is clearly linked to in the article.

And before someone replies with "you're new to slashdot aren't you", no, I'm not. I'm used to this sort of reaction from the slash community. Normally there are a few sane people that get modded up by correcting the knee jerkers, but this time it looks like everyone is preaching "every cisco switch and router has a built in username and password that can't be disabled"

Re:Can't you people READ THE F**KING ARTICLE ?

[Anonymous Coward]

And before someone replies with "you're new to slashdot aren't you", no, I'm not. I'm used to this sort of reaction from the slash community.

You know, being new to Slashdot is just like being a virgin: it's ok. You can admit it. No one will judge you for it, we were all new once.

Re:Can't you people READ THE F**KING ARTICLE ?

[Ursius]

Right the F**ing article. Wow, such incredible articulation... pause err no wait. Here is the bottom line. #1 Hardware developers use Master's all the time #2 Generally NDA, and Non-Compete keep them secret #3 Yea Right... But here is a fact for you, Mr. Intellect. (Sorry Cursing and slander doesn't go to far with me) Cisco is a hardware Developer. Questins? See 1-3 above... Maybe your right, maybe just maybe this all has to do with software running on PC. OR maybe, it has to do with Software running on a PC that can gain priviledge on a platform by using those "Hard Wired" user/password. But if you are the type that will dismiss that Cisco has this... Perhaps I can bump into a Cisco ONS 15454 and log in as "cerent". :) oops did I say that out loud? They exist. Anyway, gosh why are you so hostile towards the people who have jumped the gun? They are entitled. Though you did help some of the audience by identifying "Workaround" I'm sure there was a ton of mis-understanding. So Mr. Smeenz... Are you denying that Cisco Switches and routers have a built in username and password? (Excluding SNMP of course right?) Cheers,

Limbaugh Dies at Age 53, Suicide

[Anonymous Coward]

I just heard some sad news on talk radio -- Radio Talk Show host Rush Limbaugh was found dead in his New York home last night. The coroner has not yet officially ruled it a suicide, but apparently that's what it's going to be ruled.

I'm sure everyone in the Slashdot community will mourn his passing -- even if you didn't agree with him, there's no denying his contributions to popular culture. Truly an American icon.

joshua pencil?

[way2trivial]

I was thinking
userid "ganes" and
"Joshua" for pass

Re:joshua pencil?

[way2trivial]

tpying ahead of my hands again.

Has everyone forgotten the famous CC 'login' hack

[MadHungarian1917]

Back in the early Unix days CC when it compiled login.c would insert a back door for the developers.

Enteraysys/Cabletron devices all have back door passwords for when the user loses their passwords and these are burned into ROM and not changeable or fixable.

Do not attribute to malice what stupidity will adequately explain. In this case I think the backdoor was stupidity inserted by a developer as I recall an experience where a Cisco SE was locked out of one of these boxes and needed to use the password recovery mechanism to get in (yes the HSE and WLSE both have a power it on and apply secret handshake mode) to recover lost passwords.

A developer probably inserted this while testing the login modules (there are 5 authenticators only one of which is active at any given time) for these boxes so if they failed they could still get in and subsequently forgot to remove the backdoor.

Yes I have given up too much of my life configuring these boxes! and I am having a bad month when I do not get at least 1 bug per week listed on CCO.

Different password for every machine for safety

[billstewart]

You have to think about threat models - a system that lets one person crack every box on the internet is much more dangerous than one that requires physical access to the box to get information or physical access to the console port or reset button, and you have to decide whether you're worried about protecting secrets if the box is stolen or if that's not your problem.

The standard solution to this problem is to have the password be the serial number for the box, which you can read off the tag on the back. That way, somebody who has physical access to the box can still crack it, but you can't just attack an arbitrary box from across the Internet, because the formula depends on something that a random cracker won't know. Another variation is to use the MAC address for the box, which can be gotten by other boxes on the LAN, but is still mostly safe. And many types of hardware only let you use the administrative login from a specific port, typically a serial console port or the LAN side of a firewall or something, or only let you use the administrative login within N minutes of rebooting the box.

Somebody else mentioned the option of having a unique password that's based on the serial number of the box, which you can only get by calling the manufacturer. That's useful for your paid-option problem as well, and you can either keep a database or have the formula be "hash the serial number with a password that only the manufacturer knows", implmemented in some cryptographically strong fashion. The customer will normally do the administratively correct thing, which is to write the password on a yellow sticky note and tape it to the top of the box.

Reality check

[Anonymous Coward]

Just to put things into perspective:

you = silly linux hippy on slashdot, tinkering away at a dying OS.

cisco = 1 trillion dollar corporation that could have you arrested and shot for their CEO's amusement.

none of the people who make the buying decisions will ever hear of this news item. and no loosers, your "isp" that is ran out of your mother's basement with its cisco adsl router (sitting next to a semen encrusted sock) does not count! you are not a "CIO" or power player whose purchase decisions are going to influence cisco.

if cisco chooses to require you to wear a microchip in your forehead to access a network that uses IPv6 which is routed across a cisco router, then you will promptly comply like the little slave that you are. and you will enjoy it too!

i hope this mild adjustment of your world view back towards reality hopes you regain perspective and realize everything you say and do is futile. the big corporations own you and your entire family. give up now.

Re:Reality check

[Anonymous Coward]

c'mon, someone mod me down already. i'm dying for attention!

Can you trust closed Closed Source

[WindBourne]

No, but then again, you should not fully trust Open Source either. Think about all the openings that we have had lately and attempts at back doors. Do you really think that all of them have been caught?

Sun

[LoocSiMit]

Sun have a backdoor too.

Just ask Microsoft's cock.

Any chance this is acquired technology?

[marquis111]

With Cisco's history of buying competitors' technology and rebadging it (Kalpana XDI/CATOS, Crescendo, Aironet, PIX/Finesse OS, Lan2Lan, etc), this sounds like a leftover from one of their acquisitions. Not familiar with either of the 2 affected offerings, which is why I ask.

Re:Any chance this is acquired technology?

[Anonymous Coward]

HSE was actually developed in house for the most part. It's based on the enterprise management system and it actually doesn't work with a lot of the third party shit like CSS (Aironet) load balancer, etc.

Re:Any chance this is acquired technology?

[marquis111]

That's gotta burn Cisco. Their typical stance is
"We bought technology X (VXWorks, CATOS, Finesse, etc) because it has something to offer, then brought it up to Cisco's standards. As time goes by, we will make their interfaces more IOS-like."
IOS or anything else developed in-house is like their sacred cow.

Whether or not they should move multi-hundred-port switches (4000, 6000, 8000-series switches)from a terse and compact CLI like CATOS to IOS is a whole 'nother rant. Yes, I know one can use port ranges and other tricks in Switch IOS to address multiple ports. But for speed and directness I'll take SET commands over the mess of VLAN-database and config-commands any day when the port number is more than 12 or so. I'm one of the stubborn few who insist on running my 6509's in hybrid mode for just that reason.

Password recovery can be disabled.

[Pii]

Cisco's password recovery procedure can be disabled from Rommon, making the "configuration bypass" procedure non-functional.

Class action lawsuit, anyone?

[lightspawn]

Obviously all affected products must be taken offline ASAP and replaced with hardware from trustworthy vendors. Who's going to pay for all of this?

The username and password?

[Anonymous Coward]

I heard it was "cmdrtaco" and "gnaa", but I don't have access to any Cisco equipment, so I can't try it.

No silly, the password is not scott/tiger.

[gabbarbhai]

eom.

hey no big deal...

[siliconwafer]

... we all have backdoors! Nobody will ever figure out the password to my backdoor though!

Re:Cisco is not alone. It's industry wide practice

[Anonymous Coward]

So, they put a modem on the diagnostic port, I dial in, do the magic, and make the customer happy.

Uh. So I capture the serial connection, give you a call and .. there comes the master password?

Last time I heard..

[bindaaas]

you were running Cisco VPN server at your site. What's the IP address again ?

better

[SHEENmaster]

When they can't support a protocol, they invent a better alternative. Instead of just redundant routing, they made CARP with cryptographically secured redundant routing.

Look for it in 3.5.

its a money making scam

[Revek]

Think about how many people keep up with their "ownership rights" aka the license and service contracts. Panicked ceo's and cisco trained tech's are gonna go batshit to pay up. All of mine are behind firewalls. I like iptables.

Re:its a money making scam

[0x0d0a]

All of mine are behind firewalls. I like iptables.

"I firewall my Cisco products behind Linux firewalls."

It's a dark, dark day for Cisco.

Bullshit news

[freaksta]

This is bullshit news.. anyone that has ever worked with a cisco product or been in any type of "underground" site, will clearly see that default cisco/pass usernames have been used for AGES by cisco, and are well documented.

Re:Bullshit news

[0x0d0a]

A default password, one that simply needs to be set, is very different from a backdoor password, which is hidden, unknown to the device owner, and works even after the device owner sets his password. The article was about a backdoor password.

Re:Bullshit news

[freaksta]

I meant default password because its well known to the user. A 'trojan' would define your senario. Default cisco/pass setups are clearly marked in the user manual.

Re:Bullshit news

[freaksta]

This username cannot be disabled

But im sure you can change the password.

a 'Backdoor' this senario is not. Its a default username/pass and should be listed in a user/admin manual. RTFM.

Some facts since 1988 .

[stock]

In 1988 The name Echelon is defined : "Eavesdropping on Europe" :

October 1998 : "In October, Europe's governing body will commission a full report into the workings of Echelon, a global network of highly sensitive listening posts operated in part by America's most clandestine intelligence organization, the National Security Agency."

"British investigative journalist Duncan Campbell was the first to report about Echelon in a 1988 article in The New Statesman. He believes that there is a very thin line between intelligence gathering and commercial espionage."

Wasn't that the guy who was put behind bars by the British Queen?

Some time ago Cisco announced IOS was highly vulnerable to hack attacks, so they said : "download new fixed IOS version today!" But didn't they announce a press release that future IOS releases would contain FBI Fed hookups?

The story on that is here : "More on Cisco Building Surveillance into Routers" They talk about Eavesdropping 'must be undetectable, and such. Well now! Not so long ago a customer wanted a more powerfull cisco router, basilcy going from a 1603 to a 2600 series router.

We already had a cisco 2610 running which has 64 MB RAM in its default configuration. I checked but only the cisco 2610XM was avaliable (now 6 months ago), which highly interesting has 128 MB in its default configuration. The best part was, that a brand new cisco 2610XM at cisco's was even cheaper in price as the older cisco 2610, which cisco didn't sell anymore, but was only available on ePAy or refurbished cisco resellers.

Robert

Try to derive some positive meaning.

[Futurepower(R)]

A Slashdot comment is not a full-length essay. It doesn't say everything the author thinks. A Slashdot comment must be interpreted in the best possible fashion. Try to derive some positive meaning from each comment.

I'm not saying ALL computer companies have become abusive. But many, many have. Look at the situation with hardware. Dell often heads the list of hardware companies for abusive behavior in Ed Foster's Reader Advocate column. Dell is number 1 on Foster's Gripelog Hall of Shame Pain Index.

We are witnessing an extremely serious social breakdown. Consider Enron, Worldcom and Tyco.

It's a sad phenomenon that, when someone tries to talk about abuse, the abused begin fighting among themselves. That only assures the abuse will continue.

true dat?

[Anonymous Coward]

can you provide some kind of a link for that?
or a router to test it on?

no 127.0.0.1 is not funny in this instance

Re:true dat?

[0x0d0a]

I'd be impressed if you were posting to Slashdot from a Cisco router...

Not a chance.

[kinema]

"Can we really trust closed-source vendors, such as Cisco, to develop secure products that are free of backdoors?"

No.

What's wrong with Symantec?

[empaler]

You're just jealous because you can't predict which virae will be released next week and charge extortionate prices for securing your clients from them before anyone else knows they exist...

Well..

[dmalloc]

To all of those who have had a Cisco Tech in their deparment because some appliance showed wierd behaviour it shouzld be nothing new that there seem to be a lot of hidden features in IOS. The many times they have hacked some "magic code" into the device and then restored data which should have never been there in the first place does seem to suggest there is more to IOS than meets the human eyes. In my particular case there even seems to be a very special debug and diagnostic mode nowhere mentioned. The VPN Concentrator we used could only be "fixed" using that mode to determine the failure. While that does not seem to be as much of an issue as a hidden user/password it does make you think what can happen when user/password + debug mode are used to crawl around the innards of your devices...

Please learn how to use links.

[Anonymous Coward]

Please learn how to use links.

<a href="http://lists.netsys.com/pipermail/full-discl osure/2003-October/012809.html">One that got through</a>.

yields: One that got through.

Worthy of Salt...

[Allen Zadr]

Yeah, but - any Cisco admin worth his salt is rarely faced with a security problem in any form. Most of the vulnerabilities listed for Cisco IOS (my experience with Cisco) have been port blockable - with a notable exception.

That said, the propogation of problems from this will be from people who buy this type of equipment, but don't hire a Cisco admin at all. In Soviet Russia, the wireless network hacks you. That's to say, when I find my network is being 'worked' within the next several months, chances are, it'll be from one of these switches - where someone gave themselves access, and are now attacking me from the parking lot of "joebob-widget-mfg.com".

Downgrade

[Allen Zadr]

I think this is true of any device. Certainly, it's usually possible to downgrade an upgraded product. For Cisco IOS (for instance) it's possible to load an older version of the IOS firmware.

I don't get the point though, once upgraded - the vulnerability (or known backdoor is closed), so a downgrade would, in theory, have to be a concious decision on the part of the administrator of the equipment.

TACs

[GarryOwen]

You are right about the TACs, though my favorite is the Brussels one. Especially if you get a female engineer on the otherside....

Once Cisco's support made me feel somewhat guilty. I called in a hardware replacement request and sure enough the guy shows up in about 3 hours. However, later on I foundout that one of the worst blizzards ever was going on outside (I had been in the datacenter the last 16 hours).

what is the login/pass? will they not tell you?

[Anonymous Coward]

my business runs some cisco wireless equipment and i want to test to see if this is really enabled on them. is cisco not disclosing the actual login/pass and just letting you know that some people may know? i want to find out and check my equipment damn it!

Some back doors are reasonably secure

[hains]

So, they put a modem on the diagnostic port, I dial in, do the magic, and make the customer happy.

Based on what other people have said in previous threads, this company did it right.

A diagnostic port that is usually physically disconnected from the machine meets the requirement that only someone with access to the machine can use the back door.

It's only bad if you leave the diagnostic port connected all the time.

Not just Cisco...

[color of static]

If you ever loose a password for an Extreme Switch then you will find they have the same thing embedded in their gear. I took over a couple of large chasis type switches as part of a reorg, and I didn't have the password for either of them. When I called Extreme to get the reset procedure they insisted that I had to connect the switch to a modem or open Internet connection and let them reset the password using a secret system (read backdoor).

Needless to say I replaced the switches with something else that cost less then the next year's maintanence and have slept much better. The sad part is that Extreme sales guys never could understand why I was unhappy with that situation.

Minimize the untrustworthy people in our lives.

[Futurepower(R)]

I completely agree.

I thought that was funny. Rephrasing: "We have no other option but to accept people who are not completely trustworthy, but, of course, I choose the most trustworthy server software."

We are seeing software companies be so abusive that their business is becoming largely abuse, rather than software. It's extraordinary in business to have a business partner that can change a contract at any time unilaterally.

blah

[2names]

If he is proven to have been murdered, then I will change my thoughts no the matter. However, the current ruling is that it was a suicide, which I feel is a cowardly way out, especially when you have a child to think about. The guy was a fucking heroin junkie anyway, so good riddance to him. No need to have those fucked up genes polluting our pool.

I have no respect for those who choose to commit suicide. Respect is earned. Writing a few decent songs does not earn my respect. The fucking loser should have cleaned up his act and taken care of his family.

So, in short...

NO, FUCK YOU SIR.